LAKA Security Authorization Manifest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://bowtiekreative.example/schemas/laka-security/authorization.schema.json",
  "title": "LAKA Security Authorization Manifest",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "authorization_id",
    "client_id",
    "approved_by",
    "valid_from",
    "valid_until",
    "allowed_modes",
    "targets",
    "limits",
    "forbidden_actions",
    "emergency_contact",
    "proof_of_control"
  ],
  "properties": {
    "authorization_id": {
      "type": "string",
      "minLength": 3
    },
    "client_id": {
      "type": "string",
      "minLength": 1
    },
    "approved_by": {
      "type": "string",
      "minLength": 1
    },
    "valid_from": {
      "type": "string",
      "format": "date-time"
    },
    "valid_until": {
      "type": "string",
      "format": "date-time"
    },
    "allowed_modes": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "enum": [
          "inventory",
          "audit",
          "passive",
          "active",
          "change",
          "containment",
          "recovery"
        ]
      }
    },
    "targets": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "kind",
          "value",
          "environments"
        ],
        "properties": {
          "kind": {
            "enum": [
              "domain",
              "hostname",
              "url",
              "ip",
              "cidr"
            ]
          },
          "value": {
            "type": "string",
            "minLength": 1
          },
          "environments": {
            "type": "array",
            "minItems": 1,
            "uniqueItems": true,
            "items": {
              "type": "string",
              "minLength": 1
            }
          }
        }
      }
    },
    "limits": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "max_requests_per_second",
        "max_concurrency",
        "max_duration_minutes"
      ],
      "properties": {
        "max_requests_per_second": {
          "type": "number",
          "exclusiveMinimum": 0,
          "maximum": 100
        },
        "max_concurrency": {
          "type": "integer",
          "minimum": 1,
          "maximum": 50
        },
        "max_duration_minutes": {
          "type": "integer",
          "minimum": 1,
          "maximum": 1440
        },
        "max_error_rate": {
          "type": "number",
          "minimum": 0,
          "maximum": 1
        },
        "max_latency_ms": {
          "type": "integer",
          "minimum": 1
        }
      }
    },
    "forbidden_actions": {
      "type": "array",
      "uniqueItems": true,
      "items": {
        "type": "string",
        "minLength": 1
      }
    },
    "maintenance_windows": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "start",
          "end"
        ],
        "properties": {
          "start": {
            "type": "string",
            "format": "date-time"
          },
          "end": {
            "type": "string",
            "format": "date-time"
          },
          "description": {
            "type": "string"
          }
        }
      }
    },
    "emergency_contact": {
      "type": "string",
      "minLength": 1
    },
    "data_handling": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "classification": {
          "type": "string"
        },
        "retention_days": {
          "type": "integer",
          "minimum": 0
        },
        "region": {
          "type": "string"
        },
        "redact": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "proof_of_control": {
      "type": "object",
      "additionalProperties": true,
      "required": [
        "method",
        "status"
      ],
      "properties": {
        "method": {
          "enum": [
            "dns-txt",
            "http-token",
            "provider-evidence",
            "client-attestation",
            "other"
          ]
        },
        "status": {
          "enum": [
            "pending",
            "verified",
            "expired",
            "revoked"
          ]
        },
        "verified_at": {
          "type": "string",
          "format": "date-time"
        },
        "evidence_reference": {
          "type": "string"
        }
      }
    },
    "signatures": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "signer",
          "signed_at",
          "signature_reference"
        ],
        "properties": {
          "signer": {
            "type": "string"
          },
          "signed_at": {
            "type": "string",
            "format": "date-time"
          },
          "signature_reference": {
            "type": "string"
          }
        }
      }
    }
  }
}