{
  "version": "0.1.0",
  "updatedAt": "2026-06-19",
  "status": "draft-owner-confirmed",
  "summary": "Risk policy for assistant action routing. This policy is intentionally conservative: destructive actions are forbidden, privileged writes are scoped, and app-owned roles stay app-owned.",
  "riskLevels": [
    {
      "id": "read",
      "requiresConfirmation": false,
      "summary": "Read or summarize data already visible to the actor."
    },
    {
      "id": "write",
      "requiresConfirmation": true,
      "summary": "Create or update non-destructive state."
    },
    {
      "id": "privileged",
      "requiresConfirmation": true,
      "summary": "Change users, roles, memberships, access, grants, workflow ACLs, or other privileged state."
    },
    {
      "id": "destructive",
      "requiresConfirmation": true,
      "assistantAllowed": false,
      "summary": "Delete, hard-remove, archive critical objects, or destroy production state. Forbidden for assistant execution."
    },
    {
      "id": "root_only",
      "requiresConfirmation": true,
      "summary": "Root-only administrative action. Assistant may route only when source app also confirms root scope."
    },
    {
      "id": "future",
      "requiresConfirmation": false,
      "assistantAllowed": false,
      "summary": "Conceptual action not wired to an adapter yet."
    }
  ],
  "confirmationModes": [
    {
      "id": "none",
      "summary": "No extra confirmation beyond ordinary chat request."
    },
    {
      "id": "explicit",
      "summary": "Assistant must show exact target, action, app, scope, and expected effect before execution."
    },
    {
      "id": "typed",
      "summary": "Reserved for very high-risk future flows. Requires typing a short confirmation phrase."
    },
    {
      "id": "forbidden",
      "summary": "Assistant refuses and should offer the nearest safe alternative."
    }
  ],
  "selfActionPolicies": [
    {
      "id": "allowed",
      "summary": "Self-targeting is allowed."
    },
    {
      "id": "blocked",
      "summary": "Self-targeting is never allowed."
    },
    {
      "id": "no_self_lockout",
      "summary": "Self-targeting is allowed only when it cannot remove the actor's own last access/admin path."
    },
    {
      "id": "app_owned",
      "summary": "Self-targeting is delegated to the app adapter because the app owns the role model."
    }
  ],
  "hardDenies": [
    {
      "id": "assistant.action.deny.delete_user",
      "summary": "Assistant must never delete a HUB/Launcher user. Offer block user or disable membership instead.",
      "safeAlternatives": ["hub.user.block", "hub.membership.disable"]
    },
    {
      "id": "assistant.action.deny.hard_delete_records",
      "summary": "Assistant must never hard-delete records, database rows, files, runtime data, storage, backups, or production state.",
      "safeAlternatives": ["hub.user.block", "hub.membership.disable", "ops.card.update_status"]
    },
    {
      "id": "assistant.action.deny.self_lockout",
      "summary": "Assistant must never let an actor remove their own last admin/access path.",
      "safeAlternatives": ["hub.invite.list_pending", "hub.user.read_admin_summary"]
    },
    {
      "id": "assistant.action.deny.cross_app_role_ownership",
      "summary": "HUB action cannot mutate internal ENGINE workflow ACL or OPS Product project roles unless routed to the app-owned adapter.",
      "safeAlternatives": ["engine.workflow.share", "ops.project.grant_member"]
    },
    {
      "id": "assistant.action.deny.prompt_only_execution",
      "summary": "Assistant must not execute actions from prompt text alone. It must resolve a registered action card and pass policy first.",
      "safeAlternatives": ["assistant.action.resolve"]
    }
  ],
  "globalRules": [
    {
      "id": "assistant.rule.registered_action_required",
      "severity": "error",
      "summary": "Every executable request must resolve to an action in assistant-actions.json."
    },
    {
      "id": "assistant.rule.destructive_forbidden",
      "severity": "error",
      "summary": "Actions with riskLevel=destructive or confirmationMode=forbidden are refused by default."
    },
    {
      "id": "assistant.rule.privileged_requires_admin_role",
      "severity": "error",
      "summary": "Actions with riskLevel=privileged require assistant_admin plus app-owned admin scope."
    },
    {
      "id": "assistant.rule.app_owned_roles_stay_app_owned",
      "severity": "error",
      "summary": "HUB may route but must not directly mutate OPS Product or ENGINE internal role models."
    },
    {
      "id": "assistant.rule.write_requires_idempotency",
      "severity": "error",
      "summary": "Write actions executed through Gateway adapters require an idempotency key."
    },
    {
      "id": "assistant.rule.audit_every_write",
      "severity": "error",
      "summary": "Write and privileged actions must emit app audit or gateway audit events."
    }
  ]
}
