{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://h33.ai/agent-zero/pctl/v1/schema.json",
  "title": "H33 Policy Control v1",
  "description": "Platform-wide unified policy schema. NOT Agent-Zero-specific — every H33 product (Auth1, Q-Sign, Agent Zero, HATS, H33-74, Privacy, Cachee, HICS) consumes this canonical schema. Per Eric Option A lock 2026-05-31: every customer-facing policy in every product reduces to a pctl_* instance. The canonical question this object answers: 'What is the rule?' Pairs with astate_* (state-at-T): pctl_* = schema (the rule); astate_* = state (what was true at T).",
  "type": "object",
  "additionalProperties": false,
  "required": ["format", "policy_id", "tenant_id", "created_at_ms", "registered_by", "display_name", "description", "who", "what", "limits", "escalation", "extensions"],
  "properties": {
    "format": {"type": "string", "const": "h33-policy-control-v1"},
    "policy_id": {"type": "string", "pattern": "^[0-9a-f]{64}$", "description": "SHA3-256 of canonical form EXCLUDING this field. Content-addressable."},
    "tenant_id": {"type": "string", "pattern": "^[0-9a-f]{32}$"},
    "created_at_ms": {"type": "integer", "minimum": 0},
    "registered_by": {"type": "string"},
    "display_name": {"type": "string", "minLength": 1},
    "description": {"type": "string"},

    "who": {
      "type": "array",
      "description": "Axis 1 — WHO this policy governs.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["kind"],
        "properties": {
          "kind": {"type": "string", "enum": ["human", "agent", "service", "organization", "device", "system"]},
          "actor_id": {"type": "string"},
          "role": {"type": "string"}
        }
      }
    },

    "what": {
      "type": "array",
      "description": "Axis 2 — WHAT operations this policy governs.",
      "items": {
        "type": "string",
        "enum": ["read", "write", "execute", "sign", "delegate", "verify", "anchor", "search", "encrypt", "decrypt", "store"]
      }
    },

    "limits": {
      "type": "object",
      "description": "Axis 3 — LIMITS under which the WHO×WHAT is permitted. Every field optional; absent = no restriction.",
      "additionalProperties": false,
      "properties": {
        "amount_max_atomic_units": {"type": "integer", "minimum": 0, "description": "Spend cap in atomic units (e.g., USD cents)."},
        "time_window_start_ms": {"type": "integer", "minimum": 0},
        "time_window_end_ms": {"type": "integer", "minimum": 0},
        "jurisdictions_allowed": {"type": "array", "items": {"type": "string"}, "description": "Federated jur_* identifiers."},
        "datasets_allowed": {"type": "array", "items": {"type": "string"}, "description": "ds_* dataset identifiers."},
        "counterparties_allowed": {"type": "array", "items": {"type": "string"}},
        "risk_score_max": {"type": "integer", "minimum": 0, "maximum": 100},
        "confidence_threshold_ppm": {"type": "integer", "minimum": 0, "maximum": 1000000, "description": "Confidence threshold in parts per million. Integer to avoid float canonicalization drift."}
      }
    },

    "escalation": {
      "type": "array",
      "description": "Axis 4 — ESCALATION rules. Any rule whose trigger matches the in-flight action invokes the corresponding 'to' party.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["to", "trigger"],
        "properties": {
          "to": {"type": "string", "enum": ["never", "human_review", "quorum", "board", "regulator", "external_party"]},
          "trigger": {"type": "string"},
          "approver_ids": {"type": "array", "items": {"type": "string"}},
          "quorum_size": {"type": "integer", "minimum": 1}
        }
      }
    },

    "extensions": {
      "description": "Per-product extension namespace. Auth1 / Q-Sign / HATS / Agent Zero / etc. each publish their own schema for this opaque-to-the-base-type field. REQUIRED field — use {} for the empty case. Verifiers validate the extension against the product's published schema.",
      "type": "object"
    }
  }
}