{"count":10,"policies":[{"action":"BLOCK","escalation_required":true,"is_enabled":true,"match_attack_type":["prompt_injection"],"match_confidence_min":0.7,"match_environment":["prod","staging"],"match_severity":["critical"],"policy_id":"AXP-CRIT-PROMPT-INJ-PROD","policy_name":"Block critical prompt injection in production","priority":100,"reason_template":"Critical prompt injection blocked in {environment}. Confidence {confidence:.2f}."},{"action":"BLOCK","escalation_required":true,"is_enabled":true,"match_attack_type":["data_exfiltration"],"match_confidence_min":0.7,"match_severity":["high","critical"],"policy_id":"AXP-EXFIL-HIGH","policy_name":"Block high-confidence data exfiltration","priority":95,"reason_template":"Suspected data exfiltration ({severity}) \u2014 blocked and escalated."},{"action":"BLOCK","escalation_required":true,"is_enabled":true,"match_attack_type":["privilege_escalation"],"match_severity":["high","critical"],"policy_id":"AXP-PRIV-ESC","policy_name":"Block privilege escalation attempts","priority":90,"reason_template":"Privilege escalation attempt blocked."},{"action":"BLOCK","escalation_required":true,"is_enabled":true,"match_attack_type":["social_engineering"],"match_severity":["critical"],"policy_id":"AXP-SOCIAL-ENG-CRIT","policy_name":"Block critical social engineering","priority":85,"reason_template":"Critical social engineering attempt blocked."},{"action":"FLAG","escalation_required":false,"is_enabled":true,"match_attack_type":["social_engineering"],"match_severity":["medium","high"],"policy_id":"AXP-SOCIAL-ENG","policy_name":"Flag social engineering","priority":70,"reason_template":"Social engineering pattern flagged for review."},{"action":"FLAG","escalation_required":false,"is_enabled":true,"match_attack_type":["reconnaissance"],"match_severity":["medium","high","critical"],"policy_id":"AXP-RECON","policy_name":"Flag reconnaissance probing","priority":60,"reason_template":"Reconnaissance behavior flagged ({severity})."},{"action":"ALLOW","escalation_required":false,"is_enabled":true,"match_environment":["demo","dev"],"match_severity":["none","low"],"policy_id":"AXP-DEMO-LOW","policy_name":"Allow low-impact events in demo/dev","priority":40,"reason_template":"Low-impact event in {environment} \u2014 allowed."},{"action":"BLOCK","escalation_required":true,"is_enabled":true,"match_severity":["critical"],"policy_id":"AXP-CATCHALL-CRIT","policy_name":"Catch-all: block any critical-severity unknown threat","priority":30,"reason_template":"Critical-severity event blocked by catch-all rule."},{"action":"FLAG","escalation_required":false,"is_enabled":true,"match_severity":["high"],"policy_id":"AXP-CATCHALL-HIGH","policy_name":"Catch-all: flag high-severity unknown threats","priority":20,"reason_template":"High-severity event flagged for review."},{"action":"ALLOW","escalation_required":false,"is_enabled":true,"policy_id":"AXP-DEFAULT-ALLOW","policy_name":"Default allow","priority":0,"reason_template":"No matching policy \u2014 default allow."}],"tenant":{"environment":"demo","tenant_id":4,"tenant_name":"Binary\u00b3 Demo (Public)","tenant_slug":"demo-public"}}