# yaml-language-server: $schema=https://occasio.ai/schemas/occasio-policy.schema.json
# Occasio policy — finance template
#
# Posture for finance / banking environments where the regulated data
# surface includes account numbers, SWIFT/BIC identifiers, and locale-
# specific PII patterns the built-in scanner does not cover.
#
# This template ADDS deny_patterns on top of the dev-default posture; it
# does not lock paths down. Pair with a strict allow_paths list if the
# deployment also requires project-scoped access.
#
# Compliance reference: docs/compliance-mapping.md (DRAFT) maps the
# stanzas in this file to SOC 2 CC controls.
version: 1

# ── Global flags ──────────────────────────────────────────────────────────────
block_secrets_in_tool_results: true
redact_secrets_in_tool_results: false
distill_tool_results: true
block_requests_over_budget: true

# ── Path-based access control ─────────────────────────────────────────────────
# Deny common credential locations. Add organisation-specific paths
# (key vaults, signed-config stores) as needed.
deny_paths:
  - ~/.ssh
  - ~/.aws
  - ~/.config/gcloud
  - ~/.gnupg

# allow_paths intentionally left empty (deny_paths is still enforced).
# Set this to your repo roots if you want to restrict reads further.
# allow_paths:
#   - ~/projects

# ── Custom deny patterns ──────────────────────────────────────────────────────
# Each pattern below is a JavaScript regex. Tested against tool output;
# a match triggers BLOCK (or REDACT if redact_secrets_in_tool_results is on).
deny_patterns:
  # SWIFT / BIC code (8 or 11 chars, ISO 9362). Covers most outbound
  # international wire-transfer artefacts that might appear in logs or
  # generated documents.
  swift-bic: "\\b[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}([A-Z0-9]{3})?\\b"

  # IBAN (International Bank Account Number, ISO 13616). Length varies by
  # country (15–34 chars); this regex captures the common shape conservatively.
  iban: "\\b[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}\\b"

  # US Social Security Number (xxx-xx-xxxx). Conservative — matches the
  # canonical hyphenated form only, to keep false positives down.
  ssn-us: "\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b"

  # Internal change / incident ticket IDs (typical Jira/ServiceNow shapes).
  # Customise per-org; ticket IDs in tool output are often associated
  # with sensitive change context.
  internal-ticket: "(INC|CHG|RITM)-[0-9]{6,}"

  # Internal JWT format (Anthropic / Auth0 / generic three-segment token).
  # The built-in scanner already catches many JWTs; this is an extra
  # belt-and-braces match for organisation-specific tokens.
  jwt: "eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+"