id: 1c-readonly-query-policy
status: active
default_mode: deny
allowed:
  - select
limits:
  max_rows: 1000
  default_rows: 100
  timeout_seconds: 30
  max_timeout_seconds: 120
deny_patterns:
  - "(?i)\\bВЫБРАТЬ\\s+РАЗРЕШЕННЫЕ\\b.*\\bПОМЕСТИТЬ\\b"
  - "(?i)\\bПОМЕСТИТЬ\\b"
  - "(?i)\\bУНИЧТОЖИТЬ\\b"
  - "(?i)\\bОБНОВИТЬ\\b"
  - "(?i)\\bВСТАВИТЬ\\b"
  - "(?i)\\bУДАЛИТЬ\\b"
  - "(?i)\\bALTER\\b"
  - "(?i)\\bDROP\\b"
  - "(?i)\\bUPDATE\\b"
  - "(?i)\\bINSERT\\b"
  - "(?i)\\bDELETE\\b"
  - "(?i)\\bCREATE\\s+(LOGIN|USER|ROLE)\\b"
  - "(?i)\\bALTER\\s+(LOGIN|USER|ROLE)\\b"
  - "(?i)\\bDROP\\s+(LOGIN|USER|ROLE)\\b"
  - "(?i)\\b(GRANT|DENY|REVOKE)\\b"
masking:
  enabled: true
  fields:
    - "(?i).*пароль.*"
    - "(?i).*телефон.*"
    - "(?i).*email.*"
    - "(?i).*почта.*"
    - "(?i).*паспорт.*"
    - "(?i).*инн.*"
audit:
  log_queries: true
  log_params: false
  log_result_rows: false
notes: "Read-only query runner policy. Connection identity comes only from the explicit base_id settings. Validate before execution and apply row limits/masking."