Publish curated Unraid-AppOps-Gateway source from ad0a390e431166c3198a2ac3bec010c2b44f2dea

backend/app/services/policy_engine.py

@@ -142,6 +142,28 @@ def evaluate_policy(
             'scope_decision': None,
         }
 
+    if action == "controller.managed-storage.initialize":
+        exact_policy = session.exec(
+            select(Policy).where(
+                (Policy.action == action) & (Policy.target == "tower/deployment-controller")
+            )
+        ).first()
+        allowed = bool(
+            target == "tower/deployment-controller"
+            and source != "voice"
+            and exact_policy is not None
+            and exact_policy.manual == "allowed"
+        )
+        return {
+            "decision": "allowed" if allowed else "blocked",
+            "reason": (
+                "Managed storage initialization requires an exact-target explicit operator policy."
+            ),
+            "risk": ACTION_RISK.get(action, "high"),
+            "policy_id": exact_policy.id if allowed and exact_policy is not None else None,
+            "scope_decision": "allowed" if allowed else None,
+        }
+
     if action in _DEFAULT_DECISIONS:
         reason = _DEFAULT_REASONS.get(action, 'Action uses default governance policy.')
         return {