{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {"name": "037 ProjectBrain Governed Operations", "slug": "037-projectbrain-governed-operations"},
  "spec": {
    "priority": 37,
    "description": "Allow ProjectBrain R2 mutations only for the bound gitea-all production client; ProjectBrain independently enforces review, approval, branch, SHA and validation gates.",
    "match": {
      "project": "gitea-all",
      "environmentClassifications": ["production"],
      "connectors": ["projectbrain"],
      "riskClasses": ["R2"],
      "toolPatterns": ["projectbrain.*"]
    },
    "conditions": {"requireEnabledClient": true, "requireBinding": true, "maxArgumentBytes": 1200000},
    "decision": "allow_if_conditions",
    "terminal": true
  }
}