{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "On-Call Autonomy Policy",
  "description": "Code outside the model enforcing permission boundaries for autonomous responder actions.",
  "policy_version": "1.0.0",
  "autonomy_levels": {
    "LEVEL_1_AUTO_EXECUTE": "Safe, reversible operational actions executed without human gatekeeping",
    "LEVEL_2_HUMAN_APPROVAL": "Code modifications or schema updates requiring human sign-off",
    "LEVEL_3_ESCALATE": "Unallowlisted, high-risk, or destructive actions blocked immediately"
  },
  "allowlisted_actions": [
    {
      "action_name": "rollback",
      "autonomy_level": "LEVEL_1_AUTO_EXECUTE",
      "allowed_commands": [
        "docker compose -f docker-compose.prod.yml up -d --no-build",
        "git checkout HEAD~1"
      ],
      "reversible": true,
      "max_executions_per_incident": 1
    },
    {
      "action_name": "restart_service",
      "autonomy_level": "LEVEL_1_AUTO_EXECUTE",
      "allowed_commands": [
        "docker compose restart backend",
        "docker compose restart frontend"
      ],
      "reversible": true,
      "max_executions_per_incident": 2
    },
    {
      "action_name": "rerun_ci_job",
      "autonomy_level": "LEVEL_1_AUTO_EXECUTE",
      "allowed_commands": [
        "gh run rerun {run_id} --failed"
      ],
      "reversible": true,
      "max_executions_per_incident": 2
    },
    {
      "action_name": "apply_patch",
      "autonomy_level": "LEVEL_2_HUMAN_APPROVAL",
      "allowed_commands": [
        "git apply /tmp/patch.diff",
        "git cherry-pick {commit_sha}"
      ],
      "requires_human_confirmation": true
    },
    {
      "action_name": "fix_ci_workflow",
      "autonomy_level": "LEVEL_2_HUMAN_APPROVAL",
      "allowed_commands": [
        "act -n -W .github/workflows/ci.yml",
        "make ci-validate"
      ],
      "requires_human_confirmation": true
    },
    {
      "action_name": "scale_deployment",
      "autonomy_level": "LEVEL_2_HUMAN_APPROVAL",
      "allowed_commands": [
        "docker compose up --scale backend=2 -d"
      ],
      "requires_human_confirmation": true
    }
  ],
  "forbidden_patterns": [
    "rm -rf",
    "DROP TABLE",
    "DROP DATABASE",
    "TRUNCATE",
    "DELETE FROM .* WHERE 1=1",
    "docker compose down -v",
    "--no-verify",
    "semgrep.*--disable",
    "npm audit.*--audit-level=none"
  ],
  "default_fallback": "LEVEL_3_ESCALATE"
}