{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paloframework.org/schemas/palo-production-profile.schema.json",
  "title": "PALO-AI Production Admission Profile",
  "type": "object",
  "required": ["format", "schemaVersion", "profileId", "deploymentId", "environment", "identity", "tenantIsolation", "persistence", "keyCustody", "executionBoundary", "observability", "independentAssurance", "decision"],
  "properties": {
    "format": { "const": "palo-production-profile" }, "schemaVersion": { "const": "1.0.0" }, "profileId": { "type": "string" }, "deploymentId": { "type": "string" }, "environment": { "enum": ["evaluation", "staging", "production"] },
    "identity": { "type": "object", "required": ["mode", "issuer", "audience", "workloadIdentity", "reviewerIdentity", "tokenExpiryEnforced", "evidenceRef"], "properties": { "mode": { "enum": ["oidc", "shared-token"] }, "issuer": { "type": "string" }, "audience": { "type": "string" }, "workloadIdentity": { "type": "boolean" }, "reviewerIdentity": { "type": "boolean" }, "tokenExpiryEnforced": { "type": "boolean" }, "evidenceRef": { "type": "string" } }, "additionalProperties": false },
    "tenantIsolation": { "type": "object", "required": ["mode", "tokenTenantBound", "claimTenantBound", "storageTenantBound", "negativeTestRef"], "properties": { "mode": { "enum": ["none", "database-per-tenant", "schema-per-tenant", "row-level-security"] }, "tokenTenantBound": { "type": "boolean" }, "claimTenantBound": { "type": "boolean" }, "storageTenantBound": { "type": "boolean" }, "negativeTestRef": { "type": "string" } }, "additionalProperties": false },
    "persistence": { "type": "object", "required": ["driver", "highAvailability", "durableQueue", "backupRecoveryTestRef", "migrationControlRef"], "properties": { "driver": { "enum": ["sqlite", "postgresql", "other-production-database"] }, "highAvailability": { "type": "boolean" }, "durableQueue": { "type": "boolean" }, "backupRecoveryTestRef": { "type": "string" }, "migrationControlRef": { "type": "string" } }, "additionalProperties": false },
    "keyCustody": { "type": "object", "required": ["provider", "privateKeyInProcess", "rotationRef", "revocationRef", "attestationRef"], "properties": { "provider": { "enum": ["process-environment", "file", "kms", "hsm", "managed-signing-service"] }, "privateKeyInProcess": { "type": "boolean" }, "rotationRef": { "type": "string" }, "revocationRef": { "type": "string" }, "attestationRef": { "type": "string" } }, "additionalProperties": false },
    "executionBoundary": { "type": "object", "required": ["connectorMode", "inProcessBypassDisabled", "oneTimeCapabilities", "receiptRequired", "outcomeVerificationRequired", "bypassResistanceTestRef", "connectorAttestationRef"], "properties": { "connectorMode": { "enum": ["in-process", "allowlisted-proxy", "remote-attested"] }, "inProcessBypassDisabled": { "type": "boolean" }, "oneTimeCapabilities": { "type": "boolean" }, "receiptRequired": { "type": "boolean" }, "outcomeVerificationRequired": { "type": "boolean" }, "bypassResistanceTestRef": { "type": "string" }, "connectorAttestationRef": { "type": "string" } }, "additionalProperties": false },
    "observability": { "type": "object", "required": ["securityEvents", "tenantSafeTelemetry", "alerting", "incidentRunbookRef", "evidenceRef"], "properties": { "securityEvents": { "type": "boolean" }, "tenantSafeTelemetry": { "type": "boolean" }, "alerting": { "type": "boolean" }, "incidentRunbookRef": { "type": "string" }, "evidenceRef": { "type": "string" } }, "additionalProperties": false },
    "independentAssurance": { "type": "object", "required": ["completed", "scope", "reportRef", "openCriticalFindings"], "properties": { "completed": { "type": "boolean" }, "scope": { "type": "string" }, "reportRef": { "type": "string" }, "openCriticalFindings": { "type": "integer", "minimum": 0 } }, "additionalProperties": false },
    "decision": { "type": "object", "required": ["status", "decidedAt", "decidedBy", "validUntil", "reasons"], "properties": { "status": { "enum": ["admitted", "denied", "conditional"] }, "decidedAt": { "type": "string", "format": "date-time" }, "decidedBy": { "type": "string" }, "validUntil": { "type": "string", "format": "date-time" }, "reasons": { "type": "array", "minItems": 1, "items": { "type": "string" } } }, "additionalProperties": false }
  },
  "allOf": [{
    "if": { "properties": { "environment": { "const": "production" } }, "required": ["environment"] },
    "then": {
      "properties": {
        "identity": { "type": "object", "properties": { "mode": { "const": "oidc" }, "workloadIdentity": { "const": true }, "reviewerIdentity": { "const": true }, "tokenExpiryEnforced": { "const": true } } },
        "tenantIsolation": { "type": "object", "properties": { "mode": { "enum": ["database-per-tenant", "schema-per-tenant", "row-level-security"] }, "tokenTenantBound": { "const": true }, "claimTenantBound": { "const": true }, "storageTenantBound": { "const": true } } },
        "persistence": { "type": "object", "properties": { "driver": { "enum": ["postgresql", "other-production-database"] }, "highAvailability": { "const": true }, "durableQueue": { "const": true } } },
        "keyCustody": { "type": "object", "properties": { "provider": { "enum": ["kms", "hsm", "managed-signing-service"] }, "privateKeyInProcess": { "const": false } } },
        "executionBoundary": { "type": "object", "properties": { "connectorMode": { "enum": ["allowlisted-proxy", "remote-attested"] }, "inProcessBypassDisabled": { "const": true }, "oneTimeCapabilities": { "const": true }, "receiptRequired": { "const": true }, "outcomeVerificationRequired": { "const": true } } },
        "observability": { "type": "object", "properties": { "securityEvents": { "const": true }, "tenantSafeTelemetry": { "const": true }, "alerting": { "const": true } } },
        "independentAssurance": { "type": "object", "properties": { "completed": { "const": true }, "openCriticalFindings": { "const": 0 } } },
        "decision": { "type": "object", "properties": { "status": { "const": "admitted" } } }
      }
    }
  }],
  "additionalProperties": false
}