{
 "$id": "https://api.cerbos.dev/v0.53.0/cerbos/policy/v1/Policy.schema.json",
 "$schema": "http://json-schema.org/draft-07/schema#",
 "definitions": {
 "cerbos.policy.v1.Condition": {
 "allOf": \[\
 {\
 "type": "object",\
 "additionalProperties": false,\
 "properties": {\
 "match": {\
 "$ref": "#/definitions/cerbos.policy.v1.Match"\
 },\
 "script": {\
 "type": "string"\
 }\
 }\
 },\
 {\
 "oneOf": \[\
 {\
 "type": "object",\
 "required": \[\
 "match"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "script"\
 \]\
 }\
 \]\
 }\
 \]
 },
 "cerbos.policy.v1.Constants": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "import": {
 "type": "array",
 "items": {
 "type": "string",
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 },
 "uniqueItems": true
 },
 "local": {
 "type": "object",
 "additionalProperties": {
 "$ref": "#/definitions/google.protobuf.Value"
 }
 }
 }
 },
 "cerbos.policy.v1.DerivedRoles": {
 "type": "object",
 "required": \[\
 "name",\
 "definitions"\
 \],
 "additionalProperties": false,
 "properties": {
 "constants": {
 "$ref": "#/definitions/cerbos.policy.v1.Constants"
 },
 "definitions": {
 "type": "array",
 "items": {
 "$ref": "#/definitions/cerbos.policy.v1.RoleDef"
 },
 "minItems": 1
 },
 "name": {
 "type": "string",
 "minLength": 1,
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 },
 "variables": {
 "$ref": "#/definitions/cerbos.policy.v1.Variables"
 }
 }
 },
 "cerbos.policy.v1.ExportConstants": {
 "type": "object",
 "required": \[\
 "name"\
 \],
 "additionalProperties": false,
 "properties": {
 "definitions": {
 "type": "object",
 "additionalProperties": {
 "$ref": "#/definitions/google.protobuf.Value"
 }
 },
 "name": {
 "type": "string",
 "minLength": 1,
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 }
 }
 },
 "cerbos.policy.v1.ExportVariables": {
 "type": "object",
 "required": \[\
 "name"\
 \],
 "additionalProperties": false,
 "properties": {
 "definitions": {
 "type": "object",
 "additionalProperties": {
 "type": "string"
 }
 },
 "name": {
 "type": "string",
 "minLength": 1,
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 }
 }
 },
 "cerbos.policy.v1.Match": {
 "allOf": \[\
 {\
 "type": "object",\
 "additionalProperties": false,\
 "properties": {\
 "all": {\
 "$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"\
 },\
 "any": {\
 "$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"\
 },\
 "expr": {\
 "type": "string"\
 },\
 "none": {\
 "$ref": "#/definitions/cerbos.policy.v1.Match.ExprList"\
 }\
 }\
 },\
 {\
 "oneOf": \[\
 {\
 "type": "object",\
 "required": \[\
 "all"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "any"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "none"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "expr"\
 \]\
 }\
 \]\
 }\
 \]
 },
 "cerbos.policy.v1.Match.ExprList": {
 "type": "object",
 "required": \[\
 "of"\
 \],
 "additionalProperties": false,
 "properties": {
 "of": {
 "type": "array",
 "items": {
 "$ref": "#/definitions/cerbos.policy.v1.Match"
 },
 "minItems": 1
 }
 }
 },
 "cerbos.policy.v1.Metadata": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "annotations": {
 "type": "object",
 "additionalProperties": {
 "type": "string"
 }
 },
 "hash": {
 "oneOf": \[\
 {\
 "type": "integer",\
 "minimum": 0\
 },\
 {\
 "type": "string",\
 "pattern": "^(?:0\|\[1-9\]\\\d\*)(?:\\\.\\\d+)?(?:\[eE\]\[+-\]?\\\d+)?$"\
 }\
 \]
 },
 "sourceAttributes": {
 "$ref": "#/definitions/cerbos.policy.v1.SourceAttributes"
 },
 "sourceFile": {
 "type": "string"
 },
 "storeIdentifer": {
 "type": "string"
 },
 "storeIdentifier": {
 "type": "string"
 }
 }
 },
 "cerbos.policy.v1.Output": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "expr": {
 "type": "string"
 },
 "when": {
 "$ref": "#/definitions/cerbos.policy.v1.Output.When"
 }
 }
 },
 "cerbos.policy.v1.Output.When": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "conditionNotMet": {
 "type": "string"
 },
 "ruleActivated": {
 "type": "string"
 }
 }
 },
 "cerbos.policy.v1.PrincipalPolicy": {
 "type": "object",
 "required": \[\
 "principal",\
 "version"\
 \],
 "additionalProperties": false,
 "properties": {
 "constants": {
 "$ref": "#/definitions/cerbos.policy.v1.Constants"
 },
 "principal": {
 "type": "string",
 "pattern": "^\[^!\\\\*\\\?\\\\[\\\\]\\\{\\\}\]+$"
 },
 "rules": {
 "type": "array",
 "items": {
 "$ref": "#/definitions/cerbos.policy.v1.PrincipalRule"
 }
 },
 "scope": {
 "type": "string",
 "pattern": "^(^$\|\\\.\|\[0-9A-Za-z\]\[\\\-0-9A-Z\_a-z\]\*(\\\.\[0-9A-Z\_a-z\]\[\\\-0-9A-Z\_a-z\]\*)\*)$"
 },
 "scopePermissions": {
 "$ref": "#/definitions/cerbos.policy.v1.ScopePermissions"
 },
 "variables": {
 "$ref": "#/definitions/cerbos.policy.v1.Variables"
 },
 "version": {
 "type": "string",
 "pattern": "^\[0-9A-Z\_a-z\]+$"
 }
 }
 },
 "cerbos.policy.v1.PrincipalRule": {
 "type": "object",
 "required": \[\
 "resource",\
 "actions"\
 \],
 "additionalProperties": false,
 "properties": {
 "actions": {
 "type": "array",
 "items": {
 "$ref": "#/definitions/cerbos.policy.v1.PrincipalRule.Action"
 },
 "minItems": 1
 },
 "resource": {
 "type": "string",
 "minLength": 1
 }
 }
 },
 "cerbos.policy.v1.PrincipalRule.Action": {
 "type": "object",
 "required": \[\
 "action",\
 "effect"\
 \],
 "additionalProperties": false,
 "properties": {
 "action": {
 "type": "string",
 "minLength": 1
 },
 "condition": {
 "$ref": "#/definitions/cerbos.policy.v1.Condition"
 },
 "effect": {
 "type": "string",
 "enum": \[\
 "EFFECT\_ALLOW",\
 "EFFECT\_DENY"\
 \]
 },
 "name": {
 "type": "string",
 "pattern": "^(\[A-Za-z\]\[\\\-\\\.0-9@-Z\_a-z\]\*)\*$"
 },
 "output": {
 "$ref": "#/definitions/cerbos.policy.v1.Output"
 }
 }
 },
 "cerbos.policy.v1.ResourcePolicy": {
 "type": "object",
 "required": \[\
 "resource",\
 "version"\
 \],
 "additionalProperties": false,
 "properties": {
 "constants": {
 "$ref": "#/definitions/cerbos.policy.v1.Constants"
 },
 "importDerivedRoles": {
 "type": "array",
 "items": {
 "type": "string",
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 },
 "uniqueItems": true
 },
 "resource": {
 "type": "string",
 "pattern": "^\[^!\\\\*\\\?\\\\[\\\\]\\\{\\\}\]+$"
 },
 "rules": {
 "type": "array",
 "items": {
 "$ref": "#/definitions/cerbos.policy.v1.ResourceRule"
 }
 },
 "schemas": {
 "$ref": "#/definitions/cerbos.policy.v1.Schemas"
 },
 "scope": {
 "type": "string",
 "pattern": "^(^$\|\\\.\|\[0-9A-Za-z\]\[\\\-0-9A-Z\_a-z\]\*(\\\.\[0-9A-Z\_a-z\]\[\\\-0-9A-Z\_a-z\]\*)\*)$"
 },
 "scopePermissions": {
 "$ref": "#/definitions/cerbos.policy.v1.ScopePermissions"
 },
 "variables": {
 "$ref": "#/definitions/cerbos.policy.v1.Variables"
 },
 "version": {
 "type": "string",
 "pattern": "^\[0-9A-Z\_a-z\]+$"
 }
 }
 },
 "cerbos.policy.v1.ResourceRule": {
 "type": "object",
 "required": \[\
 "actions",\
 "effect"\
 \],
 "additionalProperties": false,
 "properties": {
 "actions": {
 "type": "array",
 "items": {
 "type": "string",
 "minLength": 1
 },
 "minItems": 1,
 "uniqueItems": true
 },
 "condition": {
 "$ref": "#/definitions/cerbos.policy.v1.Condition"
 },
 "derivedRoles": {
 "type": "array",
 "items": {
 "type": "string",
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 },
 "uniqueItems": true
 },
 "effect": {
 "type": "string",
 "enum": \[\
 "EFFECT\_ALLOW",\
 "EFFECT\_DENY"\
 \]
 },
 "name": {
 "type": "string",
 "pattern": "^(\[A-Za-z\]\[\\\-\\\.0-9@-Z\_a-z\]\*)\*$"
 },
 "output": {
 "$ref": "#/definitions/cerbos.policy.v1.Output"
 },
 "roles": {
 "type": "array",
 "items": {
 "type": "string",
 "minLength": 1
 },
 "uniqueItems": true
 }
 }
 },
 "cerbos.policy.v1.RoleDef": {
 "type": "object",
 "required": \[\
 "name",\
 "parentRoles"\
 \],
 "additionalProperties": false,
 "properties": {
 "condition": {
 "$ref": "#/definitions/cerbos.policy.v1.Condition"
 },
 "name": {
 "type": "string",
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 },
 "parentRoles": {
 "type": "array",
 "items": {
 "type": "string",
 "minLength": 1
 },
 "minItems": 1,
 "uniqueItems": true
 }
 }
 },
 "cerbos.policy.v1.RolePolicy": {
 "allOf": \[\
 {\
 "type": "object",\
 "additionalProperties": false,\
 "properties": {\
 "parentRoles": {\
 "type": "array",\
 "items": {\
 "type": "string",\
 "minLength": 1\
 },\
 "uniqueItems": true\
 },\
 "role": {\
 "type": "string",\
 "pattern": "^\[^!\\\\*\\\?\\\\[\\\\]\\\{\\\}\]+$"\
 },\
 "rules": {\
 "type": "array",\
 "items": {\
 "$ref": "#/definitions/cerbos.policy.v1.RoleRule"\
 }\
 },\
 "scope": {\
 "type": "string",\
 "pattern": "^(^$\|\\\.\|\[0-9A-Za-z\]\[\\\-0-9A-Z\_a-z\]\*(\\\.\[0-9A-Z\_a-z\]\[\\\-0-9A-Z\_a-z\]\*)\*)$"\
 },\
 "scopePermissions": {\
 "type": "string",\
 "enum": \[\
 "SCOPE\_PERMISSIONS\_UNSPECIFIED",\
 "SCOPE\_PERMISSIONS\_REQUIRE\_PARENTAL\_CONSENT\_FOR\_ALLOWS"\
 \]\
 },\
 "version": {\
 "type": "string",\
 "pattern": "^\[0-9A-Z\_a-z\]\*$"\
 }\
 }\
 },\
 {\
 "type": "object",\
 "required": \[\
 "role"\
 \]\
 }\
 \]
 },
 "cerbos.policy.v1.RoleRule": {
 "type": "object",
 "required": \[\
 "resource",\
 "allowActions"\
 \],
 "additionalProperties": false,
 "properties": {
 "allowActions": {
 "type": "array",
 "items": {
 "type": "string",
 "minLength": 1
 },
 "minItems": 1,
 "uniqueItems": true
 },
 "condition": {
 "$ref": "#/definitions/cerbos.policy.v1.Condition"
 },
 "resource": {
 "type": "string",
 "minLength": 1
 }
 }
 },
 "cerbos.policy.v1.Schemas": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "principalSchema": {
 "$ref": "#/definitions/cerbos.policy.v1.Schemas.Schema"
 },
 "resourceSchema": {
 "$ref": "#/definitions/cerbos.policy.v1.Schemas.Schema"
 }
 }
 },
 "cerbos.policy.v1.Schemas.IgnoreWhen": {
 "type": "object",
 "required": \[\
 "actions"\
 \],
 "additionalProperties": false,
 "properties": {
 "actions": {
 "type": "array",
 "items": {
 "type": "string",
 "minLength": 1
 },
 "minItems": 1,
 "uniqueItems": true
 }
 }
 },
 "cerbos.policy.v1.Schemas.Schema": {
 "type": "object",
 "required": \[\
 "ref"\
 \],
 "additionalProperties": false,
 "properties": {
 "ignoreWhen": {
 "$ref": "#/definitions/cerbos.policy.v1.Schemas.IgnoreWhen"
 },
 "ref": {
 "type": "string",
 "minLength": 1
 }
 }
 },
 "cerbos.policy.v1.ScopePermissions": {
 "type": "string",
 "enum": \[\
 "SCOPE\_PERMISSIONS\_UNSPECIFIED",\
 "SCOPE\_PERMISSIONS\_OVERRIDE\_PARENT",\
 "SCOPE\_PERMISSIONS\_REQUIRE\_PARENTAL\_CONSENT\_FOR\_ALLOWS"\
 \]
 },
 "cerbos.policy.v1.SourceAttributes": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "attributes": {
 "type": "object",
 "additionalProperties": {
 "$ref": "#/definitions/google.protobuf.Value"
 }
 }
 }
 },
 "cerbos.policy.v1.Variables": {
 "type": "object",
 "additionalProperties": false,
 "properties": {
 "import": {
 "type": "array",
 "items": {
 "type": "string",
 "pattern": "^\[\\\-\\\.0-9A-Z\_a-z\]+$"
 },
 "uniqueItems": true
 },
 "local": {
 "type": "object",
 "additionalProperties": {
 "type": "string"
 }
 }
 }
 },
 "google.protobuf.Value": {
 "title": "Value",
 "description": "A dynamically-typed value."
 }
 },
 "allOf": \[\
 {\
 "type": "object",\
 "required": \[\
 "apiVersion"\
 \],\
 "additionalProperties": false,\
 "properties": {\
 "$schema": {\
 "type": "string"\
 },\
 "apiVersion": {\
 "type": "string",\
 "const": "api.cerbos.dev/v1"\
 },\
 "derivedRoles": {\
 "$ref": "#/definitions/cerbos.policy.v1.DerivedRoles"\
 },\
 "description": {\
 "type": "string"\
 },\
 "disabled": {\
 "type": "boolean"\
 },\
 "exportConstants": {\
 "$ref": "#/definitions/cerbos.policy.v1.ExportConstants"\
 },\
 "exportVariables": {\
 "$ref": "#/definitions/cerbos.policy.v1.ExportVariables"\
 },\
 "metadata": {\
 "$ref": "#/definitions/cerbos.policy.v1.Metadata"\
 },\
 "principalPolicy": {\
 "$ref": "#/definitions/cerbos.policy.v1.PrincipalPolicy"\
 },\
 "resourcePolicy": {\
 "$ref": "#/definitions/cerbos.policy.v1.ResourcePolicy"\
 },\
 "rolePolicy": {\
 "$ref": "#/definitions/cerbos.policy.v1.RolePolicy"\
 },\
 "variables": {\
 "type": "object",\
 "additionalProperties": {\
 "type": "string"\
 }\
 }\
 }\
 },\
 {\
 "oneOf": \[\
 {\
 "type": "object",\
 "required": \[\
 "resourcePolicy"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "principalPolicy"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "derivedRoles"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "exportVariables"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "rolePolicy"\
 \]\
 },\
 {\
 "type": "object",\
 "required": \[\
 "exportConstants"\
 \]\
 }\
 \]\
 }\
 \]
}