{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "NetworkSecurityPolicyContract",
  "description": "Deterministic JSON Schema for enterprise network access control and microsegmentation rules.",
  "type": "object",
  "required": [
    "rule_id",
    "action",
    "source",
    "destination",
    "service",
    "schedule",
    "mfa_required",
    "audit_reason"
  ],
  "properties": {
    "rule_id": {
      "type": "string",
      "pattern": "^RULE-[A-Z0-9_-]+$"
    },
    "action": {
      "type": "string",
      "enum": [
        "ALLOW",
        "DENY",
        "DROP",
        "QUARANTINE"
      ]
    },
    "source": {
      "type": "object",
      "required": [
        "type",
        "value"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "IP",
            "CIDR",
            "POD_LABEL",
            "SECURITY_GROUP",
            "SUBNET"
          ]
        },
        "value": {
          "type": "string"
        }
      }
    },
    "destination": {
      "type": "object",
      "required": [
        "type",
        "value"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "IP",
            "CIDR",
            "POD_LABEL",
            "SERVICE_ENDPOINT",
            "SECURITY_GROUP",
            "SUBNET"
          ]
        },
        "value": {
          "type": "string"
        }
      }
    },
    "service": {
      "type": "object",
      "required": [
        "protocol",
        "port"
      ],
      "properties": {
        "protocol": {
          "type": "string",
          "enum": [
            "TCP",
            "UDP",
            "ICMP",
            "ANY"
          ]
        },
        "port": {
          "type": "string"
        }
      }
    },
    "schedule": {
      "type": "string"
    },
    "mfa_required": {
      "type": "boolean"
    },
    "audit_reason": {
      "type": "string"
    }
  }
}