{
  "standard-dev": {
    "label": "Standard Development",
    "description": "Suppresses common dev workflow false positives: package managers, build subshells, commit heredocs, credential manager patterns",
    "rules": [
      {
        "scope_cat": "exec",
        "scope_subcat": "priv-escalation",
        "pattern": "sudo (apt|apt-get|brew|dnf|yum|pacman|apk|snap|port) ",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 10,
        "reason": "Package manager installs are routine system administration"
      },
      {
        "scope_cat": "inject",
        "scope_subcat": "pipe-injection",
        "pattern": "git commit.*\\$(cat",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 10,
        "reason": "Claude Code standard commit pattern using heredoc"
      },
      {
        "scope_cat": "inject",
        "scope_subcat": "pipe-injection",
        "pattern": "GH_TOKEN=\\$(pass ",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 10,
        "reason": "Standard credential manager retrieval via pass"
      },
      {
        "scope_cat": "inject",
        "pattern": "\\$(az (keyvault|account|functionapp|monitor|webapp|storage)",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 10,
        "reason": "Azure CLI subshell patterns are standard DevOps workflow"
      },
      {
        "scope_cat": "inject",
        "scope_subcat": "pipe-injection",
        "pattern": "\\$((npm bin|which|command -v|nvm |rbenv |pyenv )",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 20,
        "reason": "Standard tool path resolution subshells"
      },
      {
        "scope_cat": "inject",
        "scope_subcat": "pipe-injection",
        "pattern": "\\$((cat |echo |printf |date|basename|dirname|pwd|hostname)",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 20,
        "reason": "Benign utility command substitutions"
      },
      {
        "scope_cat": "data",
        "scope_subcat": "exfiltration",
        "pattern": "curl.*-[dX].*POST.*(localhost|127\\.0\\.0\\.1|agent-recon)",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 15,
        "reason": "Testing own API endpoints is not exfiltration"
      },
      {
        "scope_cat": "exec",
        "scope_subcat": "priv-escalation",
        "pattern": "chmod (644|755|700|600|400)\\b",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 10,
        "reason": "Standard file permissions are not privilege escalation"
      },
      {
        "scope_cat": "inject",
        "scope_subcat": "code-injection",
        "pattern": "node -e.*(console\\.|require\\(|JSON\\.|process\\.)",
        "pattern_mode": "regex",
        "action": "downgrade",
        "target_risk": "medium",
        "priority": 30,
        "reason": "Simple Node.js one-liners for testing module imports and logging"
      },
      {
        "scope_cat": "file",
        "pattern": "\\.env\\.(example|test|sample|template|development|local)",
        "pattern_mode": "regex",
        "action": "suppress",
        "priority": 15,
        "reason": "Template and example environment files are not sensitive"
      },
      {
        "scope_cat": "net",
        "scope_subcat": "network-call",
        "pattern": "curl",
        "pattern_mode": "contains",
        "action": "downgrade",
        "target_risk": "low",
        "priority": 50,
        "reason": "Curl for dev API testing; exfiltration patterns caught by higher-priority rules"
      },
      {
        "scope_cat": "data",
        "scope_subcat": "exfiltration",
        "pattern": "base64 -d",
        "pattern_mode": "contains",
        "action": "downgrade",
        "target_risk": "low",
        "priority": 40,
        "reason": "Base64 decode for debugging (no pipe to shell)"
      },
      {
        "scope_cat": "pii",
        "pattern": "\\.(test|spec|mock)\\.|__tests__|__mocks__|fixtures|testdata",
        "pattern_mode": "regex",
        "action": "downgrade",
        "target_risk": "medium",
        "priority": 15,
        "reason": "PII in test/fixture files is typically synthetic test data"
      },
      {
        "scope_cat": "pii",
        "pattern": "\\.env\\.(example|test|sample|template)",
        "pattern_mode": "regex",
        "action": "downgrade",
        "target_risk": "medium",
        "priority": 15,
        "reason": "PII in environment template files is placeholder data"
      }
    ]
  },
  "devops": {
    "label": "DevOps / Infrastructure",
    "description": "Extends Standard Development with additional suppressions for SSH, chmod, and infrastructure tooling",
    "rules": [
      {
        "scope_cat": "net",
        "scope_subcat": "ssh-connection",
        "pattern": "ssh",
        "pattern_mode": "contains",
        "action": "downgrade",
        "target_risk": "low",
        "priority": 15,
        "reason": "SSH connections expected in infrastructure work"
      },
      {
        "scope_cat": "exec",
        "scope_subcat": "priv-escalation",
        "pattern": "chmod ",
        "pattern_mode": "contains",
        "action": "suppress",
        "priority": 10,
        "reason": "Standard infrastructure permissions management"
      },
      {
        "scope_cat": "net",
        "scope_subcat": "network-call",
        "pattern": "rsync|scp",
        "pattern_mode": "regex",
        "action": "downgrade",
        "target_risk": "low",
        "priority": 15,
        "reason": "Standard infrastructure file transfer tools"
      },
      {
        "scope_cat": "exec",
        "scope_subcat": "priv-escalation",
        "pattern": "sudo ",
        "pattern_mode": "contains",
        "action": "downgrade",
        "target_risk": "medium",
        "priority": 50,
        "reason": "Sudo expected in infrastructure contexts"
      }
    ]
  },
  "strict": {
    "label": "Strict (No Suppressions)",
    "description": "All events shown at original classification - no suppressions applied",
    "rules": []
  }
}