ak.schema.policy.v1

Arkret Policy

ak.schema.policy.v1 · file: schemas/policy.schema.json

* $ · object

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

* id · string

pattern: ^ak:policy:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* schema · const "ak.schema.policy.v1"

enum: "ak.schema.policy.v1"

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* policy_kind · string (enum)

enum: "access" "encryption" "retention" "federation" "moderation" "discoverability" "join" "history_access" "plaintext_visibility" "media" "applet" "agent"

* rules · array<$ref #/$defs/policy_rule>

items · object · $ref #/$defs/policy_rule

Closed policy rule. Extension rules must carry an explicit schema_ref/profile_ref instead of adding undeclared fields to the signed policy body.

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

allOf · allOf[5] · ?

allOf · allOf[6] · ?

allOf · allOf[7] · ?

allOf · allOf[8] · ?

allOf · allOf[9] · ?

* rule_id · string

pattern: ^[a-z][a-z0-9_]{0,63}$

* kind · string (enum)

enum: "action" "resource" "server" "actor" "temporal" "rate_limit" "crypto" "moderation" "extension" "agent" "applet"

* effect · string (enum) · $ref #/$defs/policy_effect

enum: "allow" "deny" "quarantine" "require_review"

priority · integer

Rule evaluation priority. Higher values are evaluated first; omitted means 0.

example: 0

actions · array<string>

items · string

pattern: ^ak\.[a-z0-9_]+(?:\.[a-z0-9_]+)*$

resources · array<object>

items · object

* kind · string (enum)

enum: "realm" "strand" "space" "object" "service"

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

resource_ref · string

pattern: ^(ak:[a-z0-9_]+:[A-Za-z0-9._~=-]+(?::[A-Za-z0-9._~=-]+)*|did:[^\s]+)$

servers · array<$ref #/$defs/server_selector>

items · object · $ref #/$defs/server_selector

Selector for federation server policy rules. Domain rules match normalized DNS labels only; service_id exact rules take precedence in policy evaluation.

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

* kind · string (enum)

enum: "service_id" "domain" "trust_domain"

service_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

domain · string · $ref #/$defs/domain_name

Lowercase DNS A-label domain. Matching semantics are label-boundary based and defined by governance/content-moderation.md.

pattern: ^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$

match_subdomains · boolean

example: false

trust_domain · string · $ref #/$defs/trust_domain

pattern: ^ak:trust_domain:[a-z0-9][a-z0-9._\-:]{0,127}$

conditions · object

schema_ref · string

pattern: ^ak\.schema\.[a-z0-9_]+(?:\.[a-z0-9_]+)*\.v[0-9]+$

profile_ref · string

pattern: ^ak\.profile\.[a-z0-9][a-z0-9_.-]*\.v[0-9]+$

params · object

agent_target · oneOf[3] · $ref #/$defs/agent_target

oneOf · oneOf[0] · object

* kind · const "all"

enum: "all"

oneOf · oneOf[1] · object

* kind · const "controller"

enum: "controller"

* controller_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

oneOf · oneOf[2] · object

* kind · const "agent"

enum: "agent"

* agent_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

agent_operations · array<string (enum)>

items · string (enum)

enum: "join" "authorize" "execute" "read" "deliver" "publish" "serve"

applet_target · oneOf[4] · $ref #/$defs/applet_target

oneOf · oneOf[0] · object

* kind · const "all"

enum: "all"

oneOf · oneOf[1] · object

* kind · const "requester"

enum: "requester"

* actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

oneOf · oneOf[2] · object

* kind · const "installation"

enum: "installation"

* applet_id · string · $ref ./common-ids.schema.json#/$defs/applet_id

Stable canonical Applet installation identity. Applet service authority is carried separately by service_id.

pattern: ^ak:applet:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* effective_scope · oneOf[2] · $ref ./applet-install-plan.schema.json#/$defs/effective_scope

oneOf · oneOf[0] · object

* kind · const "realm"

enum: "realm"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

oneOf · oneOf[1] · object

* kind · const "circle"

enum: "circle"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* circle_id · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

oneOf · oneOf[3] · object

* kind · const "managed_actor"

enum: "managed_actor"

* actor_id · allOf[2]

allOf · allOf[0] · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

allOf · allOf[1] · object

kind · const "account"

enum: "account"

applet_operations · array<string (enum)>

items · string (enum)

enum: "install" "create_bot" "map_ghost" "join" "authorize" "execute" "read" "deliver" "publish" "serve" "invoke"

review_requirement · object · $ref #/$defs/management_review_requirement

* approver_actor_ids · array<$ref ./common-ids.schema.json#/$defs/actor_id>

items · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* threshold · integer

* max_age_seconds · integer

* default_effect · string (enum)

enum: "allow" "deny" "quarantine" "require_review"

default_review_requirement · object · $ref #/$defs/management_review_requirement

* approver_actor_ids · array<$ref ./common-ids.schema.json#/$defs/actor_id>

items · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* threshold · integer

* max_age_seconds · integer

default_operations · array<string (enum)>

Required when a managed default is require_review: only these review-capable operations use that default; nonselected operations default deny unless an explicit rule matches.

items · string (enum)

enum: "join" "publish" "create_bot" "map_ghost"

priority · integer

not_before · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* created_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

updated_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

updated_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

(^x_[a-z][a-z0-9_]{0,63}$) · any

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/policy.schema.json