Control-plane Config Schema Examples
Reference schema examples for Trust-plane config and adjacent Decision-plane catalogs — policy bundles, intent / task catalog, decision catalog, evaluation gates, model routing config.
This page collects compact schema examples for control-plane artifacts. Treat them as documentation references, not complete generated schemas. Versioned schema files under /schemas, implementation tests, and the dedicated implementation docs are the source of truth where they exist.
Trust-plane config owns policy bundles, approval gates, evaluation gates, the model profile registry, and model-routing policy. Intent/task and decision catalogs are Decision-plane catalogs governed through the control-plane lifecycle; the Trust plane validates and enforces policy bindings but does not own the business decision catalog. Signatures are an optional supply-chain deployment profile, not a baseline schema requirement. (URL retained as control-plane-config for backward compatibility.)
Policy bundle (JSON Schema)
Approval gate naming is intentionally separate from rule naming. For the returns examples, R_HIGH_VALUE_REQUIRES_APPROVAL is the rule that fires, and GATE_FINANCE_APPROVAL is the approval_gates[].gate_id referenced by then.requires_approval_gate.
This first example is a local authoring aggregate that groups a bundle with guardrails and gates. It is not the canonical PolicyBundle: in Context Pack v2, policy_layer.policy_bundles[], policy_layer.guardrails and policy_layer.approval_gates are siblings. The published schema remains authoritative; do not copy this compact aggregate into a base envelope or infer additional required fields from it.
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"$defs": {
"ApprovalMode": { "enum": ["read_only", "local_write", "network", "delegated", "destructive"] },
"Rule": {
"type": "object",
"properties": {
"rule_id": { "type": "string" },
"applies_to": {
"type": "object",
"properties": {
"intent": { "type": "string" },
"task": { "type": "string" }
}
},
"if": {},
"then": {
"type": "object",
"properties": {
"allow": { "type": "boolean" },
"approval_mode": { "$ref": "#/$defs/ApprovalMode" },
"requires": { "type": "array", "items": { "type": "string" } },
"prohibits": { "type": "array", "items": { "type": "string" } },
"requires_approval_gate": { "type": ["string", "null"] },
"arg_constraints": { "type": "object" }
},
"required": ["allow"]
},
"else": { "type": "object" },
"decision_binding": { "type": "string" },
"rationale": { "type": "string" },
"citations": { "type": "array", "items": { "type": "string" } }
},
"required": ["rule_id", "if", "then"]
},
"ApprovalGate": {
"type": "object",
"properties": {
"gate_id": { "type": "string" },
"when": {},
"required_approver_role": { "type": "string" },
"ttl_seconds": { "type": "integer", "minimum": 60 }
},
"required": ["gate_id", "when", "required_approver_role"]
}
},
"properties": {
"bundle_id": { "type": "string" },
"priority": { "type": "integer", "minimum": 0 },
"effective_from": { "type": "string", "format": "date-time" },
"policy_dsl": {
"type": "object",
"properties": {
"language": { "const": "jsonlogic" },
"rules": { "type": "array", "items": { "$ref": "#/$defs/Rule" } }
},
"required": ["language", "rules"]
},
"guardrails": {
"type": "object",
"properties": {
"must_refuse": { "type": "array", "items": { "type": "string" } },
"must_escalate": { "type": "array", "items": { "type": "string" } },
"redaction_rules": { "type": "array", "items": { "type": "string" } }
},
"required": ["must_refuse", "must_escalate", "redaction_rules"]
},
"approval_gates": { "type": "array", "items": { "$ref": "#/$defs/ApprovalGate" } },
"prohibited_claims": { "type": "array", "items": { "type": "string" } }
},
"required": ["bundle_id", "priority", "policy_dsl", "guardrails", "approval_gates"]
}This compact example exposes ApprovalMode because v1 compatibility requires it. The canonical v2 policy type also supports PolicyLayer.action_risk_policy, which constrains effect, authority, reversibility, interaction, data scope, and optional decision TTL conjunctively; see the published Context Pack schema and Governance and Safety. Do not collapse those dimensions back into one tier.
Pin the selected semantics explicitly. Normalized business outcomes use higher numeric priority, deny on equal priority and default deny; independent guardrail/escalation/approval requirements and all applicable obligations remain. Compiler tool-surfacing prohibitions instead accumulate conservatively. An applicable JsonLogic predicate error stops compilation with structured ContextCompileError; false/else remains separate and there is no base non_enforcing skip flag. Reference normalized composition does not execute JsonLogic or authenticate runtime observations.
Intent / Task Catalog (JSON Schema)
This catalog is a Decision-plane catalog. The control plane versions it and signs it only when the supply-chain profile is active, while runtime components consume it to resolve allowed intents, task templates, and decision bindings.
Intent and TaskTemplate are deployment catalog protocol shapes. Pin the resolver, full deterministic tie order and current supported entries; the reference compiler does not implement this catalog service. A template match or confidence score cannot establish execution authority.
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"$defs": {
"Intent": {
"type": "object",
"properties": {
"intent_id": { "type": "string" },
"version": { "type": "string" },
"owner_role": { "type": "string" },
"description": { "type": "string" },
"risk_class": { "enum": ["read_only", "local_write", "network", "delegated", "destructive"] },
"accepted_channels": { "type": "array", "items": { "type": "string" } },
"locale_support": { "type": "array", "items": { "type": "string" } },
"eligible_task_templates": { "type": "array", "items": { "type": "string" } }
},
"required": ["intent_id", "version", "risk_class", "eligible_task_templates"]
},
"TaskTemplate": {
"type": "object",
"properties": {
"task_template_id": { "type": "string" },
"version": { "type": "string" },
"intent_id": { "type": "string" },
"owner_role": { "type": "string" },
"decision_bindings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"decision_key": { "type": "string" },
"checkpoint_after_step": { "type": "string" }
},
"required": ["decision_key"]
}
},
"default_plan": { "type": "object" },
"eligibility_rules": {}
},
"required": ["task_template_id", "version", "intent_id", "decision_bindings", "default_plan"]
}
},
"properties": {
"catalog_version": { "type": "string" },
"intents": { "type": "array", "items": { "$ref": "#/$defs/Intent" } },
"task_templates": { "type": "array", "items": { "$ref": "#/$defs/TaskTemplate" } }
},
"required": ["catalog_version", "intents", "task_templates"]
}risk_class is the v1 catalog projection. New catalog profiles should also bind a native ActionRisk or a policy-resolvable action-risk template; approval obligations are selected by policy from those dimensions rather than inferred from the legacy tier alone.
Decision Catalog (JSON Schema)
This catalog is Decision-plane owned. Trust-plane policy may bind to decision_key values and require approvals, but it should not become the owner of allowed outcomes, evidence semantics, or business decision rights.
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"$defs": {
"DecisionSpec": {
"type": "object",
"properties": {
"decision_key": { "type": "string" },
"version": { "type": "string" },
"owner_role": { "type": "string" },
"required_evidence": { "type": "array", "items": { "type": "string" } },
"allowed_outcomes": { "type": "array", "items": { "type": "string" } },
"approval_mode": { "enum": ["read_only", "local_write", "network", "delegated", "destructive"] },
"inputs_schema_ref": { "type": "string" },
"outputs_schema_ref": { "type": "string" },
"eligibility_rules": {},
"decision_right": { "enum": ["propose", "recommend", "execute", "escalate"] },
"challenge_required": { "type": "boolean" }
},
"required": ["decision_key", "version", "required_evidence", "allowed_outcomes", "approval_mode"]
}
},
"properties": {
"catalog_version": { "type": "string" },
"decision_specs": { "type": "array", "items": { "$ref": "#/$defs/DecisionSpec" } }
},
"required": ["catalog_version", "decision_specs"]
}approval_mode remains required for v1 compatibility. It is a conservative ceiling/projection, not the native multidimensional risk contract.
AI Gateway routing config (schema pointers)
Model profiles and routing policy are Trust-plane config artifacts consumed by the AI Gateway and LLM Router. A gateway must persist routing lineage during model calls, but the documented RoutingDecision shape is a candidate profile: no canonical schema or exported type exists yet.
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"$defs": {
"ModelProfile": {
"type": "object",
"properties": {
"model_profile_id": { "type": "string" },
"provider_adapter": { "type": "string" },
"deployment_ref": { "type": "string" },
"capabilities": { "type": "object" },
"limits": { "type": "object" },
"policy": { "type": "object" },
"status": { "enum": ["healthy", "degraded", "disabled"] }
},
"required": ["model_profile_id", "provider_adapter", "deployment_ref", "capabilities", "policy", "status"]
},
"RoutingPolicy": {
"type": "object",
"properties": {
"policy_id": { "type": "string" },
"owner_role": { "type": "string" },
"default_profile": { "type": "string" },
"rules": { "type": "array", "items": { "type": "object" } }
},
"required": ["policy_id", "owner_role", "default_profile", "rules"]
}
},
"properties": {
"model_profiles": { "type": "array", "items": { "$ref": "#/$defs/ModelProfile" } },
"routing_policies": { "type": "array", "items": { "$ref": "#/$defs/RoutingPolicy" } }
},
"required": ["model_profiles", "routing_policies"]
}Evaluation gates (JSON Schema)
These local release-gate examples do not allow warn to bypass mandatory controls or safety/privacy floors. Compare useful outcomes and denied cases for the exact admitted profile/release/environment; missing or synthetic runtime evidence remains insufficient even when an aggregate score passes.
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"$defs": {
"EvalTarget": {
"type": "object",
"properties": {
"intent": { "type": "string" },
"policy": { "type": "number", "minimum": 0, "maximum": 1 },
"utility": { "type": "number", "minimum": 0, "maximum": 1 },
"latency_p99_ms": { "type": "integer", "minimum": 0 },
"safety": { "type": "number", "minimum": 0, "maximum": 1 },
"economics_cents_per_decision": { "type": "number", "minimum": 0 }
},
"required": ["intent", "policy", "utility", "safety"]
},
"ReleaseGate": {
"type": "object",
"properties": {
"metric": { "type": "string" },
"max_delta": { "type": "number" },
"verdict_on_breach": { "enum": ["block", "warn"] }
},
"required": ["metric", "max_delta", "verdict_on_breach"]
}
},
"properties": {
"eval_version": { "type": "string" },
"eval_targets": { "type": "array", "items": { "$ref": "#/$defs/EvalTarget" } },
"release_gates": { "type": "array", "items": { "$ref": "#/$defs/ReleaseGate" } }
},
"required": ["eval_version", "eval_targets", "release_gates"]
}Protected configuration and execution pins
Bind immutable exact profile/control registry definitions, actual workflow features, policy/tool/model/release refs and their canonical digests through the Execution Contract. Adding a mandatory requirement needs a new revision; neither caller flags nor a local routing/evaluation schema may demote it. Separate protected policy/release administration from prohibited self-approval, enforce expected revisions in the store, and reevaluate affected workflow evidence on change.
Current authority, stored action approval, boundary/data routes and original aggregate budget remain dispatch/resume checks. Configuration publication is not proof of enforcement. A restored checkpoint retains original limits, stable operations and uncertainty; changed interpretation needs explicit migration and reauthorization. See Control Profiles and Conformance.