# description
Structure of a declarative OpenAuditModel profile definition. This schema validates profile documents; it is NOT part of the canonical audit event schema and never constrains an audit event.

# $comment
A profile may only add constraints. Nothing in this schema can relax, replace or reinterpret the core model: the rule vocabulary can require values to be present or equal, and can do nothing else. See decisions/0008-declarative-profile-conformance.md.

# properties.profileVersion.description
Version of the profile definition format this document uses.

# properties.name.description
Profile identifier. Matches the directory the profile lives in.

# properties.version.description
Version of this profile's rules, independent of the core specification version.

# properties.coreVersions.description
Core specification versions this profile applies to. An event declaring another `specVersion` is out of scope for the profile.

# properties.rules.description
Additional requirements. A rule applies only to the events its selector matches.

# $defs.ruleId.description
Stable rule identifier, upper case and hyphen separated, such as IAM-ROLE-ASSIGN-001.

# $defs.eventName.description
Exact event name, using the core event naming rules.

# $defs.eventPrefix.description
Event name prefix, which MUST end with a dot so that `identity.role.` cannot accidentally match `identity.roles-export`.

# $defs.jsonPointer.description
Non-empty JSON Pointer, as defined by RFC 6901.

# $defs.scalar.description
Value a conditional or required-value constraint compares against. Scalars only: comparison is strict equality, never a structural match.

# $defs.condition.description
The only conditional mechanism in v0.1: one path compared for equality against one scalar. There is no expression language, no boolean combination and no nesting.

# $defs.condition.properties.path.description
Absolute JSON Pointer into the event, such as /metadata/role/privileged.

# $defs.requiredValue.description
A value that must be present and strictly equal to a scalar.

# $defs.requiredValue.properties.path.description
Absolute JSON Pointer into the event, such as /authentication/mfa.

# $defs.requiredMetadata.properties.path.description
JSON Pointer RELATIVE to /metadata. `/role/id` means `/metadata/role/id`.

# $defs.requiredMetadata.properties.type.description
JSON type the value must have. Type checking only; profiles do not embed schema fragments in v0.1.

# $defs.rule.properties.rationale.description
Why the requirement exists. Informative.

# $defs.rule.properties.severity.description
How a violation of this rule is reported. `error` fails conformance; `warning` and `info` do not. These values are the profile vocabulary and are unrelated to the privacy linter's severities.

# $defs.rule.properties.eventPrefixes.description
Event name prefixes this rule applies to.

# $defs.rule.properties.when.description
Applies the rule's requirements only when this condition holds. When the condition path is absent, the condition does not hold and the rule contributes nothing.

# $defs.rule.properties.requiredPaths.description
Absolute JSON Pointers that must resolve to a present value.

# $defs.rule.properties.requiredMetadata.description
Fields required under /metadata, with their JSON type.

# $defs.rule.properties.requiredValues.description
Values required to be present and strictly equal to a scalar.

# $defs.rule.properties.recommendedPaths.description
Absolute JSON Pointers that SHOULD resolve to a present value. Absence produces a warning and never fails conformance.