# Orchestration Agent Permissions Matrix
#
# Default: read-only across all namespace repos.
# Any state-changing action requires an explicit allow + approval rule.
# Aligned with SPB-02, SPB-04, SPB-06, SPB-12.

version: 1
default_policy: read_only

# ---------------------------------------------------------------------------
# Read scopes (always allowed unless explicitly revoked)
# ---------------------------------------------------------------------------
read:
  all_namespace_repos: true
  audit_logs: true
  governance_artifacts: true
  secrets: false           # SPB-03: orchestration agent never reads user secrets
  user_only_secret_store: false

# ---------------------------------------------------------------------------
# Write actions (deny-by-default; each must be explicitly allowed below)
# ---------------------------------------------------------------------------
write:
  - action: register_project_repo
    requires:
      - environment in [stabilizing, production]
      - approver: platform_owner
      - audit_log: true
    credential_scope: orchestrator-control-plane

  - action: validate_repo_contract
    requires:
      - environment in [experimental, stabilizing, production]
      - audit_log: true
    credential_scope: orchestrator-validate-only
    side_effects: none   # read-only check only; listed under "write" because it produces a signed validation artifact

  - action: tag_release
    requires:
      - environment == production
      - approver: platform_owner
      - approver: security_owner
      - all_release_checks_passed: true
      - audit_log: true
    credential_scope: orchestrator-release

  - action: spin_up_local_container
    requires:
      - environment == experimental
      - data_classification in [internal, low_sensitive]   # SPB-10
      - audit_log: true
    credential_scope: orchestrator-spawn-local

  - action: rotate_credential
    requires:
      - approver: security_owner
      - jit_token: true                                     # SPB-06
      - audit_log: true
    credential_scope: orchestrator-credentials

# ---------------------------------------------------------------------------
# Hard denials (never allowed regardless of approval)
# ---------------------------------------------------------------------------
deny:
  - read user_only_secret_store
  - write to .cursor/permissions.json without explicit human commit
  - any operation that would route private_sensitive data to a cloud runtime   # SPB-10
  - publish to public destinations without docs/publish publishing-policy approval
  - spawn home-lab workloads from cloud runtimes