import { PermissionRule } from '@vess-id/ai-identity';
export type PolicySource = 'org' | 'user' | 'system';
/**
 * Local policy rule — extends PermissionRule with deny support.
 * SDK PermissionRule is 'allow'-only because VCs only express positive permissions.
 * Local policy needs 'deny' to block actions before they reach the Gateway.
 */
export interface LocalPolicyRule extends Omit<PermissionRule, 'effect'> {
    effect: 'allow' | 'deny';
    source?: PolicySource;
}
export interface LocalPolicy {
    v: string;
    rules: LocalPolicyRule[];
}
export interface PolicyEvaluationResult {
    allowed: boolean;
    reason?: string;
    matchedRule?: LocalPolicyRule;
}
//# sourceMappingURL=types.d.ts.map