{
  "policyName": "EVS-TAP Zero Trust Attribute-Based Access Control (ABAC)",
  "version": "1.2.0",
  "securityEnclave": "FIPS 140-3 Cryptographic Boundary",
  "rules": [
    {
      "ruleId": "RULE-ABAC-001",
      "target": "RestrictedParoleAttestations",
      "action": "READ_WRITE",
      "subjectAttributes": {
        "role": ["CBPO_ADJUDICATOR_TIER2", "NTC_SENIOR_ANALYST", "PORT_DIRECTOR"],
        "clearanceLevel": "SECRET_OR_HIGHER",
        "mfaAuthenticated": true,
        "deviceCompliant": true
      },
      "effect": "ALLOW",
      "auditLogMandatory": true
    },
    {
      "ruleId": "RULE-ABAC-002",
      "target": "CarrierBoardingStatus",
      "action": "QUERY_BOARDING_DIRECTIVE",
      "subjectAttributes": {
        "role": ["CERTIFIED_CARRIER_GATEWAY"],
        "clientCertThumbprintVerified": true,
        "ipWhitelisted": true
      },
      "effect": "ALLOW",
      "fieldMask": ["applicantBiographics.unencrypted", "paroleHostDetails"],
      "auditLogMandatory": true
    }
  ]
}