35 lines
1.0 KiB
JSON
35 lines
1.0 KiB
JSON
{
|
|
"roles": {
|
|
"lead": ["publish", "checkpoint", "handoff", "read", "audit", "configure_isolation"],
|
|
"write": ["publish", "checkpoint", "handoff", "read"],
|
|
"read": ["read"],
|
|
"audit": ["read", "audit"]
|
|
},
|
|
"isolation_profiles": [
|
|
{
|
|
"name": "level1-directory",
|
|
"label": "Level 1 — directory workspace",
|
|
"level": 1,
|
|
"mechanism": "directory_workspace",
|
|
"description": "Single mission cell in an isolated workspace directory.",
|
|
"supports_resume": true
|
|
},
|
|
{
|
|
"name": "level2-mount-namespace",
|
|
"label": "Level 2 — mount namespace",
|
|
"level": 2,
|
|
"mechanism": "mount_namespace",
|
|
"description": "Mount-namespace isolation with explicit mission-cell mounts.",
|
|
"supports_resume": true
|
|
},
|
|
{
|
|
"name": "level3-rootless-podman",
|
|
"label": "Level 3 — rootless Podman",
|
|
"level": 3,
|
|
"mechanism": "rootless_podman",
|
|
"description": "Rootless Podman cell for the strongest process and filesystem containment.",
|
|
"supports_resume": true
|
|
}
|
|
]
|
|
}
|