policy customer_support_v1 version "1.0" {
  metadata {
    owner: "Argus Gate packs"
    domain: software_development
    standards: ["owasp-asi"]
    created: "2026-10-22"
    serial: 1
    not_before: "2026-01-01T00:00:00Z"
    not_after: "2027-10-22T00:00:00Z"
    signer: pack_policy_key
    signature: ed25519:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  }

  action_bounds {
    allow QUERY with target matches "mcp:helpdesk/**"
    allow COMMUNICATE with target matches "mcp:helpdesk/reply*"
    allow MODIFY_STATE with target matches "mcp:helpdesk/refund*"
    deny  COMMUNICATE with target matches "mcp:helpdesk/export**"
    deny  MODIFY_STATE with target matches "mcp:helpdesk/delete**"
    deny  ACTUATE
    deny  DELEGATE
    deny  HALT
  }

  value_bounds {
    refund_amount: [0, 100]  unit: usd fault_action: clamp
    exports:       [0, 0]    unit: count fault_action: safe_halt
    pii_fields:    [0, 0]    unit: count fault_action: safe_halt
  }

  rate_limits {
    COMMUNICATE: 30 per 1h algorithm: sliding_window
  }

  sequence {
    escalate after 2 consecutive POLICY_DENIED to monitor
  }

  escalation {
    on policy_violation restrict_to { allow only QUERY } halt_after: never
  }

  delegation { }

  provenance {
    require_model_identity: false
    require_weight_hash: false
    require_context_hash: true
    require_hardware_attestation: false
    require_provider_attestation: false
    max_proposal_age: 5s
  }
}
