ControllerPolicyState

"""
Per-controller IO/exec allowlists pushed alongside edgeApps on config.update (hybrid-bridge §35). Default-deny on first boot — a controller with no policy row receives empty lists, which the bridge treats as 'reject everything'.
"""
type ControllerPolicyState @iac_resource(name: "controller_policy") @iac_ops(create: "createControllerPolicy", read: "getControllerPolicy", update: "updateControllerPolicy", delete: "deleteControllerPolicy") {
  """Unique identifier"""
  id: ControllerPolicyID! @iac_identity(assignedBy: SERVER) @iac_computed
  """Controller this policy applies to"""
  controllerId: ControllerID! @iac_ref(resource: "controller")
  """
  Prefix-allowlist consulted by bridge.io.* and the local.file RPC. Empty list = deny all IO.
  """
  allowedIoPaths: [String!]!
  """
  Absolute-path allowlist consulted by bridge.exec.run. Empty list = deny all exec.
  """
  allowedExecBinaries: [String!]!
  """Creation timestamp (ISO8601)"""
  createdAt: String! @iac_computed
  """Last update timestamp (ISO8601)"""
  updatedAt: String! @iac_computed
}