{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://standards.rootblocks.com/schemas/security/redaction-policy.v1.schema.json",
  "title": "RootBlocks Redaction Policy v1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "policyId",
    "version",
    "appliesTo",
    "sensitiveFieldNames",
    "sensitivePatterns",
    "replacement",
    "failClosed",
    "redactionEvidenceRequired",
    "rules"
  ],
  "properties": {
    "schemaVersion": {
      "const": "rootblocks.redaction-policy/v1"
    },
    "policyId": {
      "$ref": "#/$defs/id"
    },
    "version": {
      "$ref": "#/$defs/semver"
    },
    "appliesTo": {
      "type": "array",
      "minItems": 1,
      "items": {
        "enum": ["standards", "templates", "fixtures", "logs", "traces", "evidence", "bundles", "mcp-resources"]
      },
      "uniqueItems": true
    },
    "sensitiveFieldNames": {
      "type": "array",
      "minItems": 1,
      "items": {
        "enum": [
          "rawPayload",
          "rawValue",
          "rawSecret",
          "secretValue",
          "plainTextSecret",
          "password",
          "token",
          "apiKey",
          "connectionString",
          "privateKey",
          "authorization",
          "setCookie"
        ]
      },
      "uniqueItems": true
    },
    "sensitivePatterns": {
      "type": "array",
      "minItems": 1,
      "items": {
        "enum": ["github-token", "private-key-block", "aws-access-key", "slack-token", "jwt", "connection-string-with-credential"]
      },
      "uniqueItems": true
    },
    "replacement": {
      "enum": ["[REDACTED]"]
    },
    "failClosed": {
      "type": "boolean"
    },
    "redactionEvidenceRequired": {
      "type": "boolean"
    },
    "rules": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/rule"
      }
    }
  },
  "$defs": {
    "id": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
    },
    "semver": {
      "type": "string",
      "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(-[A-Za-z0-9.-]+)?(\\+[A-Za-z0-9.-]+)?$"
    },
    "rule": {
      "type": "object",
      "additionalProperties": false,
      "required": ["id", "target", "action", "evidenceRequired"],
      "properties": {
        "id": {
          "$ref": "#/$defs/id"
        },
        "target": {
          "enum": ["field-name", "pattern", "raw-payload", "secret-reference", "mcp-resource"]
        },
        "action": {
          "enum": ["replace", "drop", "hash-reference", "block"]
        },
        "evidenceRequired": {
          "type": "boolean"
        }
      }
    }
  }
}