/**
 * #365 `org validate` taint checks for `policy.access: 'full'` roles: the
 * risk is untrusted content reaching a full-access role and steering it
 * (prompt injection), now with a real shell.
 *
 * There is no dedicated "untrusted input" flag on a role or a formal
 * messaging graph in the schema (RoleSchema has no allow-list of who may
 * `org_send` a role, only `review_input: 'artifact-only'`, which restricts a
 * DIFFERENT thing — cold review framing). This module uses the two concrete,
 * documented untrusted-content surfaces named in #365/#360 as its heuristic:
 * a non-empty `policy.webAllow`, and a `tool_providers` entry whose name
 * looks like a communications/social surface (mono-agent's own message/
 * people/social/email tool providers, which are ordinary `mcp-stdio`
 * providers from this schema's point of view — there is nothing else to key
 * on). The messaging graph is approximated by `reports_to` edges (a role can
 * be reached by, and can reach, its manager and its direct reports) — the
 * only reachability relationship this schema expresses; a richer messaging
 * model would replace this later.
 */
import type { OrgDef, OrgRole } from './types.js';
/** A role that reads inbound third-party content directly. */
export declare function isUntrustedInputRole(role: OrgRole): boolean;
/** `org validate` findings for every `policy.access: 'full'` role in `def`.
 *
 *  Direct taint (the full-access role itself is an untrusted-input role):
 *  always an error — never overridable, matching #365 ("must not read
 *  inbound third-party content itself").
 *
 *  Indirect taint (an untrusted-input role can reach the full-access role
 *  via `reports_to`): an error unless the org's
 *  `run_config.accept_full_access_taint` names the path (either the full
 *  arrow-joined path, or just its two endpoints as `source→target`) — in
 *  which case it is downgraded to a warning so it stays visible without
 *  blocking `org validate`. Accepting a path is human-only and covered by
 *  the accepting role's `access_ack` hash (access-ack.ts), so an
 *  unacknowledged edit to the accept list suspends full access exactly like
 *  any other config drift. */
export declare function fullAccessTaintFindings(def: OrgDef): {
    errors: string[];
    warnings: string[];
};
//# sourceMappingURL=access-taint.d.ts.map