{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/siakitem/my-pi/main/pi-permission-system/schemas/hard-guards.schema.json",
  "title": "Pi Permission System Hard Guards",
  "description": "Global-only allow exceptions and non-overridable deny rules evaluated before ordinary policy, session grants, and AutoReview.",
  "type": "object",
  "properties": {
    "$schema": { "type": "string" },
    "version": { "const": 1 },
    "permission": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          { "$ref": "#/$defs/hardValue" },
          {
            "type": "object",
            "additionalProperties": { "$ref": "#/$defs/hardValue" }
          }
        ]
      }
    }
  },
  "required": ["version", "permission"],
  "additionalProperties": false,
  "$defs": {
    "hardValue": {
      "oneOf": [
        { "enum": ["allow", "deny"] },
        {
          "type": "object",
          "properties": {
            "action": { "const": "deny" },
            "reason": { "type": "string", "minLength": 1, "maxLength": 500 }
          },
          "required": ["action"],
          "additionalProperties": false
        }
      ]
    }
  }
}