{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {"name": "041 AppOps Governed Operations", "slug": "041-appops-governed-operations"},
  "spec": {
    "priority": 41,
    "description": "Allow only bounded typed AppOps mutations after Hub identity, binding and AppOps exact-target policy checks; no generic shell, Docker socket or human-approval bypass is introduced.",
    "match": {
      "project": "server-ops",
      "environmentClassifications": ["production"],
      "connectors": ["appops"],
      "riskClasses": ["R2", "R3"],
      "toolPatterns": [
        "server.operation.request",
        "server.operation.execute",
        "server.job.cancel",
        "server.project.reconcile",
        "server.deployment.target.enroll",
        "server.deployment.apply",
        "server.deployment.rollback"
      ]
    },
    "conditions": {"requireEnabledClient": true, "requireBinding": true, "maxArgumentBytes": 65536},
    "decision": "allow_if_conditions",
    "terminal": true
  }
}