{
  "policy_set_id": "ps_vendor_security_review_template",
  "schema_version": 1,
  "scope": {
    "tenant_id": "tnt_demo",
    "workflow_id": "wf_security_review",
    "channel": "email"
  },
  "defaults": {
    "citation_required": true,
    "abstain_when_evidence_missing": true,
    "low_confidence_threshold": 0.78
  },
  "approval_rules": [
    {
      "rule_id": "rule_external_security_request",
      "when": {
        "risk_flags": ["external_requester"],
        "action_type": ["zendesk_create_ticket", "jira_create_issue"]
      },
      "requires_approval": true,
      "reviewer_role": "security_reviewer",
      "reason": "External security requests need a human reviewer before system-of-record updates."
    },
    {
      "rule_id": "rule_policy_exception",
      "when": {
        "evidence_state": "missing_or_stale"
      },
      "requires_approval": true,
      "reviewer_role": "policy_owner",
      "reason": "Answers based on missing or stale evidence must route to the policy owner."
    }
  ],
  "kill_switches": {
    "disable_execution": false,
    "disable_external_notifications": false
  }
}