{
  "agent_id": "agent:SYNTHETIC DEMO \u2014 NOT A CUSTOMER",
  "downstream": {
    "timeout_s": 30,
    "url": "http://127.0.0.1:8765/mcp"
  },
  "evidence": {
    "dir": "./evidence",
    "key_path": "./evidence/ledger.key"
  },
  "mode": "http",
  "notes": "Schema cain42.mcpgate.policy.v1. Generated by CAIN-42 from review mcp-20261103-0efbaae7. Default deny: a tool not listed here is refused. This is a starting policy, not a certification. Review every verdict, set tenant_id and downstream.url, and test in staging before production. allow=2 approval=3 deny=3.",
  "policy": {
    "default": "deny",
    "max_argument_bytes": 262144,
    "require_capability_token": false,
    "tools": {
      "delete_database": {
        "reason": "high-severity finding; fix the tool before an agent may call it",
        "verdict": "deny"
      },
      "execute_sql": {
        "reason": "medium-severity finding; a human approves each call until it is fixed",
        "verdict": "approval"
      },
      "fetch_url": {
        "reason": "high-severity finding; fix the tool before an agent may call it",
        "verdict": "deny"
      },
      "get_weather": {
        "reason": "no finding matched and the name is read-only; re-review when the definition changes",
        "verdict": "allow"
      },
      "read_customer_file": {
        "reason": "medium-severity finding; a human approves each call until it is fixed",
        "verdict": "approval"
      },
      "run_shell_command": {
        "reason": "medium-severity finding; a human approves each call until it is fixed",
        "verdict": "approval"
      },
      "search_docs": {
        "reason": "no finding matched and the name is read-only; re-review when the definition changes",
        "verdict": "allow"
      },
      "send_email": {
        "reason": "high-severity finding; fix the tool before an agent may call it",
        "verdict": "deny"
      }
    }
  },
  "server": {
    "host": "127.0.0.1",
    "port": 8421
  },
  "tenant_id": "REPLACE_WITH_CUSTOMER_TENANT",
  "version": 1
}