{
  "name": "aios-gitops-enterprise-ui-policy",
  "version": "1.0.0",
  "scope": "portal-gitops-dashboard",
  "client_side_notice": "Client-side RBAC is advisory only. Server-side Actions/API authorization remains authoritative.",
  "roles": {
    "viewer": {
      "label": "Viewer",
      "permissions": [
        "read:baseline",
        "read:versions",
        "read:diff",
        "read:patch",
        "read:model",
        "read:runtime",
        "read:audit"
      ]
    },
    "developer": {
      "label": "Developer",
      "inherits": ["viewer"],
      "permissions": [
        "write:branch",
        "write:plan"
      ]
    },
    "admin": {
      "label": "Admin",
      "inherits": ["developer"],
      "permissions": [
        "write:model",
        "write:model_priority",
        "request:rollback",
        "request:tag"
      ]
    },
    "owner": {
      "label": "Owner",
      "inherits": ["admin"],
      "permissions": [
        "approve:rollback",
        "approve:tag",
        "approve:priority",
        "approve:release"
      ]
    }
  },
  "risk_policy": {
    "direct_main_write": "disabled_in_ui",
    "api_keys_in_git": "forbidden",
    "rollback": "request_only",
    "tag_create": "request_only_by_default",
    "runtime_change": "request_only",
    "baseline_high_risk_change": "request_only",
    "bulk_delete": "forbidden"
  },
  "secret_redaction": {
    "enabled": true,
    "patterns": [
      "api_key",
      "apikey",
      "authorization",
      "bearer",
      "token",
      "password",
      "secret",
      "private_key",
      "credential"
    ],
    "replacement": "[REDACTED]"
  },
  "approval_queues": [
    "rollback",
    "tag",
    "model_priority",
    "release",
    "runtime_change"
  ]
}