export type KbxPermissionRisk = 'low' | 'medium' | 'high'
export type KbxPermissionPresentation = 'hide' | 'disable'

export interface KbxPermissionDefinition {
  id: string
  module: 'OMS' | 'ERP' | 'WMS' | 'COMMON'
  resource: string
  action: string
  risk: KbxPermissionRisk
  description: string
  presentation: KbxPermissionPresentation
  backendRequired: boolean
}

export interface KbxSensitiveDataPolicy {
  id: string
  fields: string[]
  defaultExposure: 'masked'
  viewPermission: string
  revealPermission: string
  unmaskedExportPermission: string
  auditRequired: boolean
  aiExposure: 'masked-only' | 'deny'
  telemetryExposure: 'never'
  reasonRequired: boolean
}

export interface KbxAuthorizationDecision {
  allowed: boolean
  permission: string
  presentation: KbxPermissionPresentation
  reason?: string
}