{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paloframework.org/schemas/palo-agentic-policy-decision.schema.json",
  "title": "PALO Agentic Policy Decision",
  "description": "Developer-preview policy-decision contract. An allowed status is not proof that an action is safe, lawful, currently authorized, exactly once, executed, or durably evidenced.",
  "type": "object",
  "required": ["format", "schemaVersion", "decisionId", "claimId", "agentId", "status", "reasons", "policyVersion", "profileVersion", "claimDigest", "decidedAt", "obligations"],
  "properties": {
    "format": { "const": "palo-agentic-policy-decision" },
    "schemaVersion": { "const": "1.0.0" },
    "decisionId": { "type": "string", "pattern": "^decision-[a-f0-9-]{36}$" },
    "claimId": { "type": "string", "pattern": "^claim-[a-f0-9-]{36}$" },
    "agentId": { "type": "string", "pattern": "^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$" },
    "status": { "enum": ["allowed", "denied", "pending_approval"] },
    "reasons": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
    "policyVersion": { "type": "string", "minLength": 1 },
    "profileVersion": { "type": "string", "minLength": 1 },
    "claimDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
    "decidedAt": { "type": "string", "format": "date-time" },
    "approvalId": { "type": "string", "pattern": "^approval-[a-f0-9-]{36}$" },
    "obligations": { "type": "array", "items": { "type": "string", "minLength": 1 } },
    "enforcementProvider": {
      "type": "object",
      "description": "Portable reference to the provider that produced the pre-action decision. It is evidence linkage, not vendor endorsement or proof of provider integrity.",
      "required": ["providerId", "providerVersion", "policyReference"],
      "properties": {
        "providerId": { "type": "string", "pattern": "^provider-[a-zA-Z0-9][a-zA-Z0-9._-]{2,100}$" },
        "providerVersion": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
        "policyReference": { "type": "string", "minLength": 1, "maxLength": 500 },
        "decisionReference": { "type": "string", "minLength": 1, "maxLength": 500 },
        "evidenceDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
      },
      "additionalProperties": false
    }
  },
  "allOf": [
    { "if": { "properties": { "status": { "const": "pending_approval" } }, "required": ["status"] }, "then": { "properties": { "approvalId": {} }, "required": ["approvalId"] } }
  ],
  "additionalProperties": false
}