# Configuration, requirements and IAM

Prefer the [XML schemas dialect](schema-manual://schema-xml-1/authoring) for embedded schemas. It supports native form annotations such as `input-type="password"`, `related-resource="device"`, `editor-language="lua"`, and `property-order`. Existing JSON text and CDATA remain supported; each resource keeps its existing validation and execution restrictions.

Inline configuration-schema describes an object using JSON Schema draft 2020-12.
It advertises required instance input; it never supplies installation values.
Each schema is limited to 256 KiB and 50 levels. References must be local within
that schema; external references and nested schema resource ids are rejected.

Resources advertise logical binding ids and types. Installation resolves these
requirements to actual tenant entities. optional="true" permits an unbound resource.
Typed IAM allow and deny statements reference declared ids or the wildcard.

```xml
<integration id="com.example.requirements" version="1.0.0" sdk-version="2.0">
  <configuration-schema>
    <schema type="object" xmlns="urn:cococo:json-schema:1">
      <property name="endpoint" type="string"/>
      <property name="token" type="string" write-only="true"/>
      <required name="endpoint"/>
      <required name="token"/>
    </schema>
  </configuration-schema>
  <resources><resource id="erp" type="protocol/http"><description>ERP connection</description></resource></resources>
  <policy><allow><action>device:*</action><resource>erp</resource></allow></policy>
</integration>
```

The installer supplies the ERP device and its configuration. An invalid policy
reference fails during compilation, before any draft or instance is created.

```xml
<integration id="com.example.invalid-reference" version="1.0.0" sdk-version="2.0">
  <policy><allow><action>device:*</action><resource>missing</resource></allow></policy>
</integration>
```

Read Actors and Actions next to add behavior. The remaining chapters describe
optional features; a first Integration does not need to include them all.