{
 "language": "cain.gov.source/1",
 "namespace": "acme.ops",
 "policies": [
  {
   "abstract": true,
   "authority": {
    "from": "rig"
   },
   "id": "shell_base",
   "kind": "exec",
   "max_uses": 5,
   "product": "openshell",
   "resource": "/srv/app",
   "ttl_s": 600,
   "when": [
    {
     "argv0_in": [
      "ls",
      "cat",
      "echo",
      "grep"
     ]
    },
    {
     "max_timeout_s": 30
    },
    {
     "cwd_under": [
      "/srv/app"
     ]
    }
   ]
  },
  {
   "extends": "shell_base",
   "id": "alice_logs",
   "max_uses": 3,
   "purpose": "read application logs",
   "resource": "/srv/app/logs",
   "subject": "alice",
   "when": [
    {
     "argv0_in": [
      "cat",
      "grep",
      "rm"
     ]
    },
    {
     "max_argc": 4
    },
    {
     "utc_hour_window": [
      0,
      24
     ]
    }
   ]
  },
  {
   "id": "alice_notes",
   "kind": "memory_write",
   "max_uses": 10,
   "product": "memvault",
   "purpose": "store run notes",
   "resource": "memvault/ns/alice",
   "subject": "alice",
   "ttl_s": 300,
   "when": [
    {
     "namespace_in": [
      "alice",
      "shared"
     ]
    },
    {
     "source_type_in": [
      "user",
      "tool"
     ]
    },
    {
     "max_content_bytes": 4096
    }
   ]
  },
  {
   "id": "alice_evidence",
   "kind": "evidence_register",
   "product": "scitt",
   "purpose": "register run evidence",
   "resource": "scitt/application/cain-run+json",
   "subject": "alice",
   "ttl_s": 120,
   "when": [
    {
     "payload_type_in": [
      "application/cain-run+json"
     ]
    }
   ]
  }
 ],
 "tenant": "tenant-a",
 "valid_until_ms": 1790086400000
}