/**
 * PolicyEngine enforces access policies and data classification rules.
 */
export type DataClassification = 'public' | 'internal' | 'confidential' | 'restricted';
export type AccessLevel = 'read' | 'write' | 'execute' | 'admin';
export interface AccessPolicy {
    id: string;
    name: string;
    description: string;
    /** Domain this policy applies to, or '*' for all */
    domain: string;
    /** Minimum data classification level required */
    minClassification: DataClassification;
    /** Roles that are granted access */
    allowedRoles: string[];
    /** Specific users granted access (overrides roles) */
    allowedUsers: string[];
    /** Access level granted */
    accessLevel: AccessLevel;
    enabled: boolean;
}
export interface AccessCheckResult {
    allowed: boolean;
    reason?: string;
    matchedPolicy?: string;
}
export interface UserContext {
    userId: string;
    roles: string[];
    department?: string;
}
export declare class PolicyEngine {
    private policies;
    constructor(policies?: AccessPolicy[]);
    addPolicy(policy: AccessPolicy): void;
    removePolicy(id: string): void;
    listPolicies(): AccessPolicy[];
    /**
     * Check if a user can access a block in a given domain with a given classification.
     */
    checkAccess(user: UserContext, domain: string, classification: DataClassification, requiredLevel?: AccessLevel): AccessCheckResult;
    /**
     * Get the effective classification for a set of table/column references.
     * In production, this would query a data catalog.
     */
    classifyData(tables: string[], classificationMap: Record<string, DataClassification>): DataClassification;
}
//# sourceMappingURL=policy-engine.d.ts.map