{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "permission": {
      "type": "object",
      "properties": {
        "rbac": {
          "type": "object",
          "properties": {
            "policies-csv-file": {
              "type": "string"
            },
            "conditionalPoliciesFile": {
              "type": "string",
              "description": "The path to the yaml file containing the conditional policies",
              "visibility": "frontend"
            },
            "policyFileReload": {
              "type": "boolean",
              "description": "Allow for reloading of the CSV and conditional policies files.",
              "visibility": "frontend"
            },
            "admin": {
              "type": "object",
              "properties": {
                "users": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string",
                        "visibility": "frontend"
                      }
                    },
                    "required": [
                      "name"
                    ]
                  },
                  "description": "The list of users and / or groups with admin access",
                  "visibility": "frontend"
                },
                "superUsers": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string",
                        "visibility": "frontend"
                      }
                    },
                    "required": [
                      "name"
                    ]
                  },
                  "description": "The list of super users that will have allow all access, should be a list of only users",
                  "visibility": "frontend"
                }
              },
              "description": "Optional configuration for admins",
              "visibility": "frontend"
            },
            "pluginsWithPermission": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "An optional list of plugin IDs. The RBAC plugin will handle access control for plugins included in this list."
            },
            "maxDepth": {
              "type": "number",
              "description": "An optional value that limits the depth when building the hierarchy group graph",
              "visibility": "frontend"
            },
            "policyDecisionPrecedence": {
              "type": "string",
              "enum": [
                "basic",
                "conditional"
              ],
              "description": "An optional value that controls evaluation order between basic permission policy and conditional policy for permissions.\n- Default: \"conditional\"\n- \"basic\": prefer permission policy first\n- \"conditional\": prefer conditional policies first",
              "visibility": "frontend"
            },
            "useOwnershipEntityRefs": {
              "type": "boolean",
              "description": "When enabled, group-to-role bindings are also evaluated using ownership entity refs from the sign-in token, not only catalog memberOf relations. Defaults to false."
            },
            "defaultPermissions": {
              "type": "object",
              "properties": {
                "defaultRole": {
                  "type": "string",
                  "description": "The default role to assign to all authenticated users."
                },
                "basicPermissions": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "permission": {
                        "type": "string",
                        "description": "Permission name or resource type, for example `catalog.entity.read` or `catalog-entity`."
                      },
                      "action": {
                        "type": "string",
                        "enum": [
                          "create",
                          "read",
                          "update",
                          "delete",
                          "use"
                        ],
                        "description": "Action for the permission. Defaults to `use` when omitted."
                      }
                    },
                    "required": [
                      "permission",
                      "action"
                    ]
                  },
                  "description": "The list of baseline basic permissions assigned to the default role."
                }
              },
              "required": [
                "defaultRole",
                "basicPermissions"
              ],
              "description": "Configuration for assigning a default role with permissions to all authenticated users."
            },
            "validation": {
              "type": "object",
              "properties": {
                "conditionalPolicies": {
                  "type": "object",
                  "properties": {
                    "maxConditionDepth": {
                      "type": "number",
                      "description": "Maximum nesting depth for conditional criteria trees."
                    },
                    "maxConditionNodeCount": {
                      "type": "number",
                      "description": "Maximum total number of criteria nodes in a condition tree."
                    },
                    "maxCriteriaItems": {
                      "type": "number",
                      "description": "Maximum number of items in `allOf`/`anyOf` criteria arrays."
                    }
                  },
                  "description": "Limits for conditional policy payload shape and nesting."
                },
                "conditionalPoliciesFile": {
                  "type": "object",
                  "properties": {
                    "maxBytes": {
                      "type": "number",
                      "description": "Maximum size in bytes for the conditional policies YAML file."
                    },
                    "maxDocuments": {
                      "type": "number",
                      "description": "Maximum number of YAML documents allowed in the conditional file."
                    }
                  },
                  "description": "Limits for YAML-based conditional policy file ingestion."
                }
              },
              "description": "Optional validation tuning for conditional policies."
            }
          }
        }
      },
      "required": [
        "rbac"
      ]
    }
  },
  "required": [
    "permission"
  ]
}