name = "baseline"
version = "1.0.0"
description = "Sensible governance defaults for any team: secret redaction, auto read mode, 90-day audit expectation"

[context]
default_read_mode = "auto"
audit_retention_days = 90

[redaction]
# Private key blocks (PEM) — never context material.
private_key = '-----BEGIN [A-Z ]*PRIVATE KEY-----'
# AWS access key ids.
aws_access_key = '\bAKIA[0-9A-Z]{16}\b'
# Generic credential assignments: api_key/secret/password/token = "value"
# (\x27 = single quote, kept out of the TOML literal string).
credential_assignment = '(?i)\b(api[_-]?key|secret|passwd|password|auth[_-]?token)\b\s*[:=]\s*["\x27][^"\x27]{8,}["\x27]'
# Bearer tokens in headers or curl snippets.
bearer_token = '(?i)\bbearer\s+[a-z0-9_\-\.=]{20,}'
