{% set enforcement = row['enforcement'] %}
{% set off_allowlist = enforcement in ('flagged', 'blocked') %}
{% set redaction_count = redactions | length %}
<div class="allowlist">
  <div class="head">
    {% if enforcement == 'blocked' %}
      <span class="ic" style="color: var(--danger);">✗</span>
      <span style="color: var(--danger);">Blocked — off-allowlist, stopped with 403 (not sent)</span>
    {% elif enforcement == 'flagged' %}
      <span class="ic" style="color: var(--warn);">⚠</span>
      <span style="color: var(--warn);">Flagged — off-allowlist, but forwarded to the cloud (warn policy)</span>
    {% else %}
      <span class="ic" style="color: var(--accent-2);">✓</span>
      <span style="color: var(--accent-2);">Allowed — destination matches policy</span>
    {% endif %}
  </div>
  <ul>
    <li class="{% if enforcement == 'blocked' %}bad{% elif enforcement == 'flagged' %}warn{% else %}match{% endif %}">
      <span>{% if enforcement == 'blocked' %}✗{% elif enforcement == 'flagged' %}⚠{% else %}✓{% endif %}</span>
      <span>
        <b>{{ row['host'] }}</b>
        {% if off_allowlist %} is not on{% else %} is on{% endif %}
        the {{ row['tool'] or 'Unknown' }} allowlist
      </span>
    </li>
    <li class="{% if enforcement == 'flagged' %}warn{% else %}match{% endif %}">
      <span>{% if enforcement == 'blocked' %}✗{% elif enforcement == 'flagged' %}⚠{% else %}✓{% endif %}</span>
      <span>
        {% if enforcement == 'blocked' %}
          request stopped — never reached the cloud
        {% elif enforcement == 'flagged' %}
          request was forwarded to the cloud anyway
        {% else %}
          request forwarded to an allowed destination
        {% endif %}
      </span>
    </li>
    <li class="match">
      <span>✓</span>
      <span>TLS handshake completed ({{ row['scheme'] }})</span>
    </li>
    <li class="{% if redaction_count %}warn{% else %}match{% endif %}">
      <span>{% if redaction_count %}⚠{% else %}✓{% endif %}</span>
      <span>
        {% if redaction_count %}
          {{ redaction_count }} secret pattern{{ '' if redaction_count == 1 else 's' }} stripped before forward
        {% else %}
          no secrets matched the redaction rules
        {% endif %}
      </span>
    </li>
  </ul>
</div>