{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Tau administrator configuration",
  "type": "object",
  "additionalProperties": false,
  "required": ["schemaVersion"],
  "properties": {
    "schemaVersion": {
      "const": 1
    },
    "enrollment": {
      "type": "boolean"
    },
    "settings": {
      "type": "object",
      "properties": {
        "core.authority.requirements": {
          "type": "object",
          "properties": {
            "allowedSandboxModes": {
              "type": "array",
              "uniqueItems": true,
              "items": {
                "enum": ["read-only", "workspace-write", "danger-full-access"]
              }
            },
            "allowedApprovalPolicies": {
              "type": "array",
              "uniqueItems": true,
              "items": {
                "enum": ["untrusted", "on-request", "never"]
              }
            },
            "allowedApprovalsReviewers": {
              "type": "array",
              "uniqueItems": true,
              "items": {
                "enum": ["user", "auto-review"]
              }
            },
            "rules": {
              "type": "object",
              "properties": {
                "prefixRules": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "required": ["pattern", "decision"],
                    "properties": {
                      "pattern": {
                        "type": "array",
                        "minItems": 1,
                        "items": {
                          "anyOf": [
                            {
                              "type": "string",
                              "minLength": 1
                            },
                            {
                              "type": "object",
                              "additionalProperties": false,
                              "required": ["token"],
                              "properties": {
                                "token": {
                                  "type": "string",
                                  "minLength": 1
                                }
                              }
                            },
                            {
                              "type": "object",
                              "additionalProperties": false,
                              "required": ["anyOf"],
                              "properties": {
                                "anyOf": {
                                  "type": "array",
                                  "minItems": 1,
                                  "items": {
                                    "type": "string",
                                    "minLength": 1
                                  }
                                }
                              }
                            }
                          ]
                        }
                      },
                      "decision": {
                        "enum": ["allow", "prompt", "forbidden"]
                      },
                      "justification": {
                        "type": "string"
                      }
                    }
                  }
                }
              }
            },
            "permissions": {
              "type": "object",
              "properties": {
                "filesystem": {
                  "type": "object",
                  "properties": {
                    "denyRead": {
                      "type": "array",
                      "items": {
                        "type": "string",
                        "minLength": 1
                      }
                    }
                  }
                }
              }
            },
            "networkAccess": {
              "type": "boolean"
            },
            "sentinelExtraPolicy": {
              "type": "string",
              "maxLength": 4000
            },
            "shellEnvironmentPolicy": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "inherit": {
                  "enum": ["all", "core", "none"]
                },
                "ignoreDefaultExcludes": {
                  "type": "boolean"
                },
                "exclude": {
                  "type": "array",
                  "maxItems": 256,
                  "uniqueItems": true,
                  "items": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 4096
                  }
                },
                "includeOnly": {
                  "type": "array",
                  "maxItems": 256,
                  "uniqueItems": true,
                  "items": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 4096
                  }
                }
              }
            }
          }
        }
      }
    },
    "features": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "allow": {
          "type": "array",
          "maxItems": 256,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 4096
          }
        },
        "deny": {
          "type": "array",
          "maxItems": 256,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 4096
          }
        }
      }
    },
    "permissions": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "network": {
          "type": "object",
          "additionalProperties": false,
          "required": ["allow"],
          "properties": {
            "allow": {
              "type": "array",
              "maxItems": 256,
              "uniqueItems": true,
              "items": {
                "type": "string",
                "minLength": 1,
                "maxLength": 4096
              }
            },
            "deny": {
              "type": "array",
              "maxItems": 256,
              "uniqueItems": true,
              "items": {
                "type": "string",
                "minLength": 1,
                "maxLength": 4096
              }
            },
            "ports": {
              "type": "array",
              "minItems": 1,
              "maxItems": 256,
              "items": {
                "type": "integer",
                "minimum": 1,
                "maximum": 65535
              }
            },
            "allowPrivate": {
              "type": "boolean"
            },
            "allowLocal": {
              "type": "boolean"
            },
            "allowMetadata": {
              "type": "boolean"
            }
          }
        }
      }
    }
  }
}