{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {
    "name": "Global Default Deny",
    "slug": "global-deny"
  },
  "spec": {
    "priority": 0,
    "description": "Deny every action unless a more specific allow policy and all security invariants match.",
    "match": {},
    "conditions": {},
    "decision": "deny",
    "terminal": false
  }
}