{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://docs.connectsoft.ai/reference/schemas/blueprint-security.schema.json",
  "title": "Security Blueprint (blueprint-security-v1)",
  "description": "Descriptor document of the Security Blueprint kind (BC-02). Validated by BlueprintService; metadata per blueprint-common.schema.json; generation outputs and validation rules per model/blueprints.yaml.",
  "type": "object",
  "required": [
    "metadata",
    "identity",
    "operations",
    "dataClassification",
    "secrets",
    "threats"
  ],
  "additionalProperties": false,
  "properties": {
    "metadata": {
      "$ref": "blueprint-common.schema.json#/$defs/Metadata"
    },
    "identity": {
      "type": "object",
      "required": [
        "platform"
      ],
      "properties": {
        "platform": {
          "enum": [
            "canonical-adr-0101"
          ]
        },
        "authorizationServer": {
          "type": "string"
        },
        "workloadIdentity": {
          "type": "boolean"
        }
      },
      "additionalProperties": false
    },
    "operations": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "operation",
          "scope",
          "roles"
        ],
        "properties": {
          "operation": {
            "type": "string"
          },
          "scope": {
            "type": "string"
          },
          "roles": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "sideEffectClass": {
            "$ref": "blueprint-common.schema.json#/$defs/SideEffectClass"
          }
        },
        "additionalProperties": false
      }
    },
    "dataClassification": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "entity",
          "classification"
        ],
        "properties": {
          "entity": {
            "type": "string"
          },
          "classification": {
            "$ref": "blueprint-common.schema.json#/$defs/Classification"
          }
        },
        "additionalProperties": false
      }
    },
    "secrets": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "store"
        ],
        "properties": {
          "name": {
            "type": "string"
          },
          "store": {
            "enum": [
              "key-vault"
            ]
          },
          "rotationDays": {
            "type": "integer"
          }
        },
        "additionalProperties": false
      }
    },
    "threats": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "threat",
          "control"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "threat": {
            "type": "string"
          },
          "control": {
            "type": "string"
          }
        },
        "additionalProperties": false
      }
    }
  }
}