{
  "id": "policy.{operation}.v1",
  "name": "{Operation} Policy",
  "description": "Pre-action governance for {operation} operations. {Brief description of what this policy protects and enforces}.",
  "version": "1.0.0",
  "status": "active",
  "requires_capabilities": ["{capability.name}"],
  "min_assurance": "L2",
  "limits_required": ["require_assurance_at_least", "idempotency_required"],
  "required_fields": ["field1", "field2"],
  "optional_fields": ["optional_field1", "optional_field2"],
  "enforcement": {
    "assurance_required": "limits.{capability}.require_assurance_at_least",
    "idempotency_required": true
  },
  "mcp": {
    "require_allowlisted_if_present": true
  },
  "advice": [
    "Cache /verify with ETag; 60s TTL",
    "Subscribe to status webhooks for instant suspend",
    "Log all {operation} attempts for Verifiable Attestation",
    "Implement appropriate rate limiting",
    "Use idempotency keys to prevent duplicate operations",
    "Provide clear error messages to help agents self-remediate"
  ],
  "required_context": {
    "$schema": "http://json-schema.org/draft-07/schema#",
    "type": "object",
    "required": ["field1", "field2"],
    "properties": {
      "field1": {
        "type": "string",
        "minLength": 1,
        "description": "Description of field1"
      },
      "field2": {
        "type": "string",
        "description": "Description of field2"
      },
      "optional_field1": {
        "type": "string",
        "description": "Description of optional field1"
      },
      "optional_field2": {
        "type": "integer",
        "minimum": 0,
        "description": "Description of optional field2"
      },
      "mcp_servers": {
        "type": "array",
        "items": { "type": "string" },
        "description": "MCP servers being used in this request (e.g., [\"https://mcp.stripe.com\", \"https://mcp.notion.com\"])"
      },
      "mcp_tools": {
        "type": "array",
        "items": { "type": "string" },
        "description": "MCP tools being used in this request (e.g., [\"stripe.refunds.create\", \"notion.pages.export\"])"
      },
      "mcp_server": {
        "type": "string",
        "description": "Single MCP server being used (backward compatibility - use mcp_servers array for multiple)"
      },
      "mcp_tool": {
        "type": "string",
        "description": "Single MCP tool being used (backward compatibility - use mcp_tools array for multiple)"
      },
      "mcp_session": {
        "type": "string",
        "description": "MCP session identifier for audit trail (optional)"
      }
    }
  },
  "evaluation_rules": [
    {
      "name": "passport_status_active",
      "condition": "passport.status == 'active'",
      "deny_code": "oap.passport_suspended",
      "description": "Passport must be active"
    },
    {
      "name": "assurance_minimum",
      "condition": "passport.assurance_level >= limits.{capability}.require_assurance_at_least",
      "deny_code": "oap.assurance_insufficient",
      "description": "Assurance level must meet minimum requirement"
    },
    {
      "name": "capability_check",
      "condition": "'{capability.name}' in passport.capabilities",
      "deny_code": "oap.unknown_capability",
      "description": "Agent must have required capability"
    },
    {
      "name": "idempotency_check",
      "condition": "idempotency_key not in recent_keys",
      "deny_code": "oap.idempotency_conflict",
      "description": "Idempotency key must be unique"
    }
  ],
  "cache": {
    "default_ttl_seconds": 60,
    "suspend_invalidate_seconds": 30
  },
  "deprecation": null,
  "created_at": "2025-01-30T00:00:00Z",
  "updated_at": "2025-01-30T00:00:00Z"
}