{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.anguskit.com/schema/anguscopilot-knowledge/1.0.0-alpha/access-control.json",
  "title": "Knowledge Access Control",
  "description": "知识库访问控制（与 §14.4.8 对齐）。",
  "type": "object",
  "properties": {
    "defaultPolicy": {
      "type": "string",
      "enum": ["allow", "deny"],
      "default": "deny"
    },
    "rules": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["subject", "objects", "actions"],
        "properties": {
          "subject": {
            "type": "object",
            "properties": {
              "roles": { "type": "array", "items": { "type": "string", "minLength": 1 } },
              "groups": { "type": "array", "items": { "type": "string", "minLength": 1 } },
              "userIds": { "type": "array", "items": { "type": "string" } }
            },
            "patternProperties": { "^x-": true },
            "unevaluatedProperties": false
          },
          "objects": {
            "type": "object",
            "properties": {
              "labels": {
                "type": "object",
                "additionalProperties": {
                  "type": "array",
                  "items": { "type": "string" }
                }
              },
              "paths": { "type": "array", "items": { "type": "string" } }
            },
            "patternProperties": { "^x-": true },
            "unevaluatedProperties": false
          },
          "actions": {
            "type": "array",
            "items": { "type": "string", "enum": ["read", "list", "search"] },
            "uniqueItems": true,
            "minItems": 1
          },
          "effect": {
            "type": "string",
            "enum": ["allow", "deny"],
            "default": "allow"
          }
        },
        "patternProperties": { "^x-": true },
        "unevaluatedProperties": false
      }
    }
  },
  "patternProperties": { "^x-": true },
  "$comment": "F8 跨字段约束。",
  "if": {
    "properties": { "defaultPolicy": { "const": "deny" } },
    "required": ["defaultPolicy"]
  },
  "then": {
    "required": ["rules"],
    "properties": {
      "rules": { "minItems": 1 }
    }
  },
  "unevaluatedProperties": false
}