29 lines
1.0 KiB
YAML
29 lines
1.0 KiB
YAML
{
|
|
"apiVersion": "hub.example.com/v1alpha1",
|
|
"kind": "Policy",
|
|
"metadata": {"name": "041 AppOps Governed Operations", "slug": "041-appops-governed-operations"},
|
|
"spec": {
|
|
"priority": 41,
|
|
"description": "Allow only bounded typed AppOps mutations after Hub identity, binding and AppOps exact-target policy checks; no generic shell, Docker socket or human-approval bypass is introduced.",
|
|
"match": {
|
|
"project": "server-ops",
|
|
"environmentClassifications": ["production"],
|
|
"connectors": ["appops"],
|
|
"riskClasses": ["R2", "R3"],
|
|
"toolPatterns": [
|
|
"server.operation.request",
|
|
"server.operation.execute",
|
|
"server.job.cancel",
|
|
"server.project.reconcile",
|
|
"server.deployment.target.enroll",
|
|
"server.deployment.apply",
|
|
"server.deployment.rollback",
|
|
"server.appops.self_upgrade.apply"
|
|
]
|
|
},
|
|
"conditions": {"requireEnabledClient": true, "requireBinding": true, "maxArgumentBytes": 65536},
|
|
"decision": "allow_if_conditions",
|
|
"terminal": true
|
|
}
|
|
}
|