{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://gopura.net/schemas/key-policy.json",
  "title": "Gopura Guard key policy",
  "description": "The policy attached to a Gopura API key. Set per key in the admin console — it CANNOT be supplied in a request body to create a ring-fence. A request may carry a policy object that only TIGHTENS the key’s policy (more denials, a lower token ceiling); anything that would loosen it is ignored.",
  "type": "object",
  "properties": {
    "version": {
      "type": "number",
      "const": 1
    },
    "scope": {
      "type": "string",
      "maxLength": 4000
    },
    "deny": {
      "maxItems": 7,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "code",
          "math",
          "roleplay",
          "medical",
          "legal",
          "financial-advice",
          "personal-data"
        ]
      }
    },
    "systemPrompt": {
      "type": "string",
      "maxLength": 20000
    },
    "refusal": {
      "type": "string",
      "maxLength": 2000
    },
    "escalate": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "message": {
          "type": "string",
          "maxLength": 2000
        }
      },
      "required": [
        "enabled"
      ],
      "additionalProperties": false
    },
    "maxOutputTokens": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "maximum": 200000
    },
    "bannedPatterns": {
      "maxItems": 32,
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 200
      }
    },
    "guard": {
      "type": "object",
      "properties": {
        "input": {
          "type": "boolean"
        },
        "output": {
          "type": "boolean"
        },
        "model": {
          "type": "string",
          "minLength": 1,
          "maxLength": 120
        },
        "mode": {
          "type": "string",
          "enum": [
            "block",
            "monitor"
          ]
        },
        "onError": {
          "type": "string",
          "enum": [
            "block",
            "allow"
          ]
        },
        "onBlock": {
          "type": "string",
          "enum": [
            "refuse",
            "error"
          ]
        },
        "stream": {
          "type": "string",
          "enum": [
            "scan",
            "buffer"
          ]
        }
      },
      "additionalProperties": false
    }
  },
  "required": [
    "version"
  ],
  "additionalProperties": false
}