{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://opencontextprotocol.org/schemas/v0.1/policy-pack.schema.json",
  "title": "OCP Part 3 — Policy pack (JSON projection of the declarative pack)",
  "type": "object",
  "required": ["name", "version", "description"],
  "properties": {
    "name": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
    "version": {
      "type": "string",
      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(-[0-9A-Za-z.-]+)?$"
    },
    "description": { "type": "string", "minLength": 1 },
    "extends": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
    "context": { "$ref": "#/$defs/contextRules" },
    "redaction": {
      "type": "object",
      "additionalProperties": { "type": "string", "minLength": 1 },
      "propertyNames": { "pattern": "^[a-z][a-z0-9_]*$" }
    },
    "filters": { "$ref": "#/$defs/filterRules" },
    "egress": { "$ref": "#/$defs/egressRules" }
  },
  "additionalProperties": false,
  "$defs": {
    "contextRules": {
      "type": "object",
      "properties": {
        "default_read_mode": { "type": "string" },
        "allow_tools": {
          "type": "array",
          "items": { "type": "string", "minLength": 1 }
        },
        "deny_tools": {
          "type": "array",
          "items": { "type": "string", "minLength": 1 }
        },
        "max_context_tokens": { "type": "integer", "minimum": 1 },
        "audit_retention_days": { "type": "integer", "minimum": 1 }
      },
      "additionalProperties": false
    },
    "filterAction": { "type": "string", "enum": ["off", "warn", "redact", "block"] },
    "filterRules": {
      "type": "object",
      "description": "Inbound content filters (GL #675): PII, data-classification and prompt-injection detectors run on tool output before it reaches the agent.",
      "properties": {
        "pii": { "$ref": "#/$defs/filterAction" },
        "classification": { "$ref": "#/$defs/filterAction" },
        "injection": { "$ref": "#/$defs/filterAction" },
        "blocked_labels": {
          "type": "array",
          "items": { "type": "string", "minLength": 1 }
        }
      },
      "additionalProperties": false
    },
    "egressRules": {
      "type": "object",
      "description": "Egress/output DLP (GL #676): gates agent writes & actions before they execute.",
      "properties": {
        "forbidden_patterns": {
          "type": "array",
          "items": { "type": "string", "minLength": 1 }
        },
        "block_secrets": { "type": "boolean" },
        "max_writes_per_min": { "type": "integer", "minimum": 1 }
      },
      "additionalProperties": false
    }
  }
}