#  Copyright (c) 2026 Cisco Systems, Inc. and its affiliates
#  SPDX-License-Identifier: Apache-2.0
$schema: "https://json-schema.org/draft-07/schema#"
$id: "mas/v1#governance-binding"
title: GovernanceBinding
description: >
  Governance plugin chain (ordered plugin stanzas, iptables-style). BLOCK
  stops the chain and returns that error; ALLOW passes to the next plugin.
  This is not an observability sequence — remaining plugins do not run
  after a BLOCK. Plugin ids are resolved at runtime from the plugin
  registry (see runtime/docs/plugin-registry-manifests.md) — this schema
  validates shape only (bare id, or a single id-keyed config object), not
  plugin identity. Any registered plugin, built-in or third-party, is
  valid here without editing this file.
type: array
items:
  oneOf:
    - type: string
      minLength: 1
    - type: object
      minProperties: 1
      maxProperties: 1
      additionalProperties:
        type: object