{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {
    "name": "020 Project Scope Isolation",
    "slug": "020-project-scope-isolation"
  },
  "spec": {
    "priority": 20,
    "description": "Require the token project claim, endpoint project and requested resource project to be identical.",
    "match": {
      "resourceTypes": [
        "tool",
        "resource",
        "prompt"
      ]
    },
    "conditions": {
      "allEqual": [
        "claims.project",
        "route.project",
        "request.project"
      ],
      "requiredClaims": [
        "sub",
        "aud",
        "scope",
        "project"
      ]
    },
    "decision": "allow_if_conditions",
    "terminal": false
  }
}