# MakeYourMCP Policy Schema (shipping today)
# A policy allows/denies MCP tool calls by tool NAME using glob (fnmatch)
# patterns. Deny wins over allow; default_action applies when nothing matches.
#
# Note: The schema below uses JSON (the API format). For browser-friendly
# viewing, this file demonstrates both YAML and JSON representations.
#
# YAML Representation:
# ---
# name: read-only-analyst
# default_action: deny
# rules:
#   allow:
#     - "read_*"
#     - "list_*"
#     - "get_*"
#   deny:
#     - "delete_*"
#     - "drop_*"
#     - "write_*"
#
# JSON Representation (used in API):
# {
#   "name": "read-only-analyst",
#   "default_action": "deny",
#   "rules": {
#     "allow": ["read_*", "list_*", "get_*"],
#     "deny": ["delete_*", "drop_*", "write_*"]
#   }
# }

# --- ROADMAP (not yet enforced) ---
# Future policy features under development:
# - Role-based rules: Match policies to specific agent roles
# - Resource scoping: Restrict access by connector, schema, or table
# - Runtime constraints: Row limits, column masking, IP allowlists, time windows
# - Human-in-the-loop approvals: Require manual approval for sensitive operations
# - RBAC with roles/resources/actions/constraints/approvals structure
# - YAML-based policy ingestion via the UI