@llm-dev-ops/agentics-cli 1.4.25 → 1.4.27

package/dist/bundled-agents/data-vault-agents/dist/contracts/data-access.schema.d.ts

@@ -0,0 +1,731 @@
+/**
+ * @fileoverview Data Access Control Schemas for LLM-Data-Vault Agents
+ * @description Defines schemas for data access requests, responses, and policies.
+ * These schemas are used by the data access control agent to evaluate and
+ * enforce access policies on dataset operations.
+ * @module @llm-data-vault/agents/contracts/data-access
+ */
+import { z } from 'zod';
+/**
+ * Data access actions that can be requested
+ */
+export declare const DataAccessActionSchema: z.ZodEnum<["read", "write", "delete", "export", "share", "transform", "analyze"]>;
+/**
+ * Type alias for data access actions
+ */
+export type DataAccessAction = z.infer<typeof DataAccessActionSchema>;
+/**
+ * Comparison operators for policy conditions
+ */
+export declare const ComparisonOperatorSchema: z.ZodEnum<["equals", "not_equals", "contains", "not_contains", "greater_than", "less_than", "in", "not_in", "matches"]>;
+/**
+ * Type alias for comparison operators
+ */
+export type ComparisonOperator = z.infer<typeof ComparisonOperatorSchema>;
+/**
+ * Policy condition schema
+ * @description Defines a single condition to be evaluated in a policy rule
+ */
+export declare const PolicyConditionSchema: z.ZodObject<{
+    /**
+     * The attribute/field to evaluate
+     * @example "requester.role", "context.location", "dataset.sensitivity"
+     */
+    attribute: z.ZodString;
+    /**
+     * The comparison operator to use
+     */
+    operator: z.ZodEnum<["equals", "not_equals", "contains", "not_contains", "greater_than", "less_than", "in", "not_in", "matches"]>;
+    /**
+     * The value to compare against
+     */
+    value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">, z.ZodArray<z.ZodNumber, "many">]>;
+}, "strip", z.ZodTypeAny, {
+    value: string | number | boolean | string[] | number[];
+    operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+    attribute: string;
+}, {
+    value: string | number | boolean | string[] | number[];
+    operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+    attribute: string;
+}>;
+/**
+ * TypeScript type for PolicyCondition
+ */
+export type PolicyCondition = z.infer<typeof PolicyConditionSchema>;
+/**
+ * Policy rule effect
+ */
+export declare const PolicyEffectSchema: z.ZodEnum<["allow", "deny"]>;
+/**
+ * Type alias for policy effect
+ */
+export type PolicyEffect = z.infer<typeof PolicyEffectSchema>;
+/**
+ * Policy rule schema
+ * @description Defines a single rule within an access policy
+ */
+export declare const PolicyRuleSchema: z.ZodObject<{
+    /**
+     * Unique identifier for this rule
+     */
+    rule_id: z.ZodString;
+    /**
+     * Human-readable description of the rule
+     */
+    description: z.ZodOptional<z.ZodString>;
+    /**
+     * Actions this rule applies to (empty means all actions)
+     */
+    actions: z.ZodDefault<z.ZodArray<z.ZodEnum<["read", "write", "delete", "export", "share", "transform", "analyze"]>, "many">>;
+    /**
+     * Conditions that must all be satisfied for the rule to apply
+     */
+    conditions: z.ZodArray<z.ZodObject<{
+        /**
+         * The attribute/field to evaluate
+         * @example "requester.role", "context.location", "dataset.sensitivity"
+         */
+        attribute: z.ZodString;
+        /**
+         * The comparison operator to use
+         */
+        operator: z.ZodEnum<["equals", "not_equals", "contains", "not_contains", "greater_than", "less_than", "in", "not_in", "matches"]>;
+        /**
+         * The value to compare against
+         */
+        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">, z.ZodArray<z.ZodNumber, "many">]>;
+    }, "strip", z.ZodTypeAny, {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }, {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }>, "many">;
+    /**
+     * The effect when all conditions are met
+     */
+    effect: z.ZodEnum<["allow", "deny"]>;
+    /**
+     * Priority for rule ordering (higher = evaluated first)
+     */
+    priority: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    rule_id: string;
+    effect: "allow" | "deny";
+    priority: number;
+    conditions: {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }[];
+    actions: ("read" | "write" | "delete" | "export" | "share" | "transform" | "analyze")[];
+    description?: string | undefined;
+}, {
+    rule_id: string;
+    effect: "allow" | "deny";
+    conditions: {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }[];
+    description?: string | undefined;
+    priority?: number | undefined;
+    actions?: ("read" | "write" | "delete" | "export" | "share" | "transform" | "analyze")[] | undefined;
+}>;
+/**
+ * TypeScript type for PolicyRule
+ */
+export type PolicyRule = z.infer<typeof PolicyRuleSchema>;
+/**
+ * Access Policy Schema
+ * @description Defines a complete access control policy with rules and conditions
+ *
+ * @example
+ * ```typescript
+ * const policy: AccessPolicy = {
+ *   policy_id: 'gdpr-data-access-policy',
+ *   name: 'GDPR Data Access Policy',
+ *   description: 'Enforces GDPR compliance for EU data subjects',
+ *   rules: [
+ *     {
+ *       rule_id: 'consent-required',
+ *       actions: ['read', 'export'],
+ *       conditions: [
+ *         { attribute: 'dataset.contains_pii', operator: 'equals', value: true },
+ *         { attribute: 'context.consent_given', operator: 'equals', value: false }
+ *       ],
+ *       effect: 'deny',
+ *       priority: 100
+ *     }
+ *   ],
+ *   default_effect: 'deny',
+ *   enabled: true
+ * };
+ * ```
+ */
+export declare const AccessPolicySchema: z.ZodObject<{
+    /**
+     * Unique identifier for the policy
+     */
+    policy_id: z.ZodString;
+    /**
+     * Human-readable name for the policy
+     */
+    name: z.ZodString;
+    /**
+     * Detailed description of the policy's purpose
+     */
+    description: z.ZodOptional<z.ZodString>;
+    /**
+     * Version of the policy (for tracking changes)
+     */
+    version: z.ZodDefault<z.ZodString>;
+    /**
+     * Ordered list of rules to evaluate
+     */
+    rules: z.ZodArray<z.ZodObject<{
+        /**
+         * Unique identifier for this rule
+         */
+        rule_id: z.ZodString;
+        /**
+         * Human-readable description of the rule
+         */
+        description: z.ZodOptional<z.ZodString>;
+        /**
+         * Actions this rule applies to (empty means all actions)
+         */
+        actions: z.ZodDefault<z.ZodArray<z.ZodEnum<["read", "write", "delete", "export", "share", "transform", "analyze"]>, "many">>;
+        /**
+         * Conditions that must all be satisfied for the rule to apply
+         */
+        conditions: z.ZodArray<z.ZodObject<{
+            /**
+             * The attribute/field to evaluate
+             * @example "requester.role", "context.location", "dataset.sensitivity"
+             */
+            attribute: z.ZodString;
+            /**
+             * The comparison operator to use
+             */
+            operator: z.ZodEnum<["equals", "not_equals", "contains", "not_contains", "greater_than", "less_than", "in", "not_in", "matches"]>;
+            /**
+             * The value to compare against
+             */
+            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">, z.ZodArray<z.ZodNumber, "many">]>;
+        }, "strip", z.ZodTypeAny, {
+            value: string | number | boolean | string[] | number[];
+            operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+            attribute: string;
+        }, {
+            value: string | number | boolean | string[] | number[];
+            operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+            attribute: string;
+        }>, "many">;
+        /**
+         * The effect when all conditions are met
+         */
+        effect: z.ZodEnum<["allow", "deny"]>;
+        /**
+         * Priority for rule ordering (higher = evaluated first)
+         */
+        priority: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        rule_id: string;
+        effect: "allow" | "deny";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[] | number[];
+            operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+            attribute: string;
+        }[];
+        actions: ("read" | "write" | "delete" | "export" | "share" | "transform" | "analyze")[];
+        description?: string | undefined;
+    }, {
+        rule_id: string;
+        effect: "allow" | "deny";
+        conditions: {
+            value: string | number | boolean | string[] | number[];
+            operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+            attribute: string;
+        }[];
+        description?: string | undefined;
+        priority?: number | undefined;
+        actions?: ("read" | "write" | "delete" | "export" | "share" | "transform" | "analyze")[] | undefined;
+    }>, "many">;
+    /**
+     * Additional conditions that apply to all rules
+     */
+    conditions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /**
+         * The attribute/field to evaluate
+         * @example "requester.role", "context.location", "dataset.sensitivity"
+         */
+        attribute: z.ZodString;
+        /**
+         * The comparison operator to use
+         */
+        operator: z.ZodEnum<["equals", "not_equals", "contains", "not_contains", "greater_than", "less_than", "in", "not_in", "matches"]>;
+        /**
+         * The value to compare against
+         */
+        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">, z.ZodArray<z.ZodNumber, "many">]>;
+    }, "strip", z.ZodTypeAny, {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }, {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }>, "many">>;
+    /**
+     * Default effect when no rules match
+     */
+    default_effect: z.ZodDefault<z.ZodEnum<["allow", "deny"]>>;
+    /**
+     * Whether the policy is currently active
+     */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Compliance frameworks this policy helps enforce
+     */
+    compliance_frameworks: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Metadata for tracking and auditing
+     */
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    policy_id: string;
+    name: string;
+    compliance_frameworks: string[];
+    conditions: {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }[];
+    rules: {
+        rule_id: string;
+        effect: "allow" | "deny";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[] | number[];
+            operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+            attribute: string;
+        }[];
+        actions: ("read" | "write" | "delete" | "export" | "share" | "transform" | "analyze")[];
+        description?: string | undefined;
+    }[];
+    default_effect: "allow" | "deny";
+    version: string;
+    enabled: boolean;
+    description?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
+}, {
+    policy_id: string;
+    name: string;
+    rules: {
+        rule_id: string;
+        effect: "allow" | "deny";
+        conditions: {
+            value: string | number | boolean | string[] | number[];
+            operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+            attribute: string;
+        }[];
+        description?: string | undefined;
+        priority?: number | undefined;
+        actions?: ("read" | "write" | "delete" | "export" | "share" | "transform" | "analyze")[] | undefined;
+    }[];
+    description?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    compliance_frameworks?: string[] | undefined;
+    conditions?: {
+        value: string | number | boolean | string[] | number[];
+        operator: "equals" | "not_equals" | "contains" | "not_contains" | "in" | "not_in" | "greater_than" | "less_than" | "matches";
+        attribute: string;
+    }[] | undefined;
+    default_effect?: "allow" | "deny" | undefined;
+    version?: string | undefined;
+    enabled?: boolean | undefined;
+}>;
+/**
+ * TypeScript type for AccessPolicy
+ */
+export type AccessPolicy = z.infer<typeof AccessPolicySchema>;
+/**
+ * Request context schema
+ * @description Provides contextual information about the access request
+ */
+export declare const RequestContextSchema: z.ZodObject<{
+    /**
+     * Purpose of the data access
+     */
+    purpose: z.ZodOptional<z.ZodString>;
+    /**
+     * Geographic location of the requester
+     */
+    location: z.ZodOptional<z.ZodString>;
+    /**
+     * Whether explicit consent has been given
+     */
+    consent_given: z.ZodOptional<z.ZodBoolean>;
+    /**
+     * IP address of the requester
+     */
+    ip_address: z.ZodOptional<z.ZodString>;
+    /**
+     * User agent or client information
+     */
+    user_agent: z.ZodOptional<z.ZodString>;
+    /**
+     * Session or request correlation ID
+     */
+    correlation_id: z.ZodOptional<z.ZodString>;
+    /**
+     * Additional context attributes
+     */
+    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    correlation_id?: string | undefined;
+    ip_address?: string | undefined;
+    attributes?: Record<string, unknown> | undefined;
+    user_agent?: string | undefined;
+    purpose?: string | undefined;
+    location?: string | undefined;
+    consent_given?: boolean | undefined;
+}, {
+    correlation_id?: string | undefined;
+    ip_address?: string | undefined;
+    attributes?: Record<string, unknown> | undefined;
+    user_agent?: string | undefined;
+    purpose?: string | undefined;
+    location?: string | undefined;
+    consent_given?: boolean | undefined;
+}>;
+/**
+ * TypeScript type for RequestContext
+ */
+export type RequestContext = z.infer<typeof RequestContextSchema>;
+/**
+ * Data Access Request Schema
+ * @description Represents a request to access a dataset with specified action
+ *
+ * @example
+ * ```typescript
+ * const request: DataAccessRequest = {
+ *   dataset_id: 'dataset-123',
+ *   requester_id: 'user-456',
+ *   action: 'read',
+ *   context: {
+ *     purpose: 'analytics',
+ *     consent_given: true,
+ *     location: 'EU'
+ *   },
+ *   policies: ['gdpr-policy', 'internal-policy']
+ * };
+ * ```
+ */
+export declare const DataAccessRequestSchema: z.ZodObject<{
+    /**
+     * Unique identifier of the dataset being accessed
+     */
+    dataset_id: z.ZodString;
+    /**
+     * Identifier of the entity requesting access
+     */
+    requester_id: z.ZodString;
+    /**
+     * The action being requested on the dataset
+     */
+    action: z.ZodEnum<["read", "write", "delete", "export", "share", "transform", "analyze"]>;
+    /**
+     * Contextual information about the request
+     */
+    context: z.ZodObject<{
+        /**
+         * Purpose of the data access
+         */
+        purpose: z.ZodOptional<z.ZodString>;
+        /**
+         * Geographic location of the requester
+         */
+        location: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether explicit consent has been given
+         */
+        consent_given: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * IP address of the requester
+         */
+        ip_address: z.ZodOptional<z.ZodString>;
+        /**
+         * User agent or client information
+         */
+        user_agent: z.ZodOptional<z.ZodString>;
+        /**
+         * Session or request correlation ID
+         */
+        correlation_id: z.ZodOptional<z.ZodString>;
+        /**
+         * Additional context attributes
+         */
+        attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        correlation_id?: string | undefined;
+        ip_address?: string | undefined;
+        attributes?: Record<string, unknown> | undefined;
+        user_agent?: string | undefined;
+        purpose?: string | undefined;
+        location?: string | undefined;
+        consent_given?: boolean | undefined;
+    }, {
+        correlation_id?: string | undefined;
+        ip_address?: string | undefined;
+        attributes?: Record<string, unknown> | undefined;
+        user_agent?: string | undefined;
+        purpose?: string | undefined;
+        location?: string | undefined;
+        consent_given?: boolean | undefined;
+    }>;
+    /**
+     * List of policy IDs to evaluate against
+     */
+    policies: z.ZodArray<z.ZodString, "many">;
+    /**
+     * Specific fields being requested (empty means all)
+     */
+    requested_fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Maximum number of records requested
+     */
+    record_limit: z.ZodOptional<z.ZodNumber>;
+    /**
+     * Request timestamp
+     */
+    timestamp: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    dataset_id: string;
+    context: {
+        correlation_id?: string | undefined;
+        ip_address?: string | undefined;
+        attributes?: Record<string, unknown> | undefined;
+        user_agent?: string | undefined;
+        purpose?: string | undefined;
+        location?: string | undefined;
+        consent_given?: boolean | undefined;
+    };
+    requester_id: string;
+    action: "read" | "write" | "delete" | "export" | "share" | "transform" | "analyze";
+    policies: string[];
+    timestamp?: string | undefined;
+    requested_fields?: string[] | undefined;
+    record_limit?: number | undefined;
+}, {
+    dataset_id: string;
+    context: {
+        correlation_id?: string | undefined;
+        ip_address?: string | undefined;
+        attributes?: Record<string, unknown> | undefined;
+        user_agent?: string | undefined;
+        purpose?: string | undefined;
+        location?: string | undefined;
+        consent_given?: boolean | undefined;
+    };
+    requester_id: string;
+    action: "read" | "write" | "delete" | "export" | "share" | "transform" | "analyze";
+    policies: string[];
+    timestamp?: string | undefined;
+    requested_fields?: string[] | undefined;
+    record_limit?: number | undefined;
+}>;
+/**
+ * TypeScript type for DataAccessRequest
+ */
+export type DataAccessRequest = z.infer<typeof DataAccessRequestSchema>;
+/**
+ * Access constraint schema
+ * @description Defines constraints that must be applied when access is granted
+ */
+export declare const AccessConstraintSchema: z.ZodObject<{
+    /**
+     * Type of constraint
+     */
+    type: z.ZodEnum<["field_restriction", "row_filter", "rate_limit", "time_window", "anonymization_required", "audit_required", "encryption_required"]>;
+    /**
+     * Constraint-specific parameters
+     */
+    parameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    /**
+     * Human-readable description
+     */
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "field_restriction" | "row_filter" | "rate_limit" | "time_window" | "anonymization_required" | "audit_required" | "encryption_required";
+    parameters: Record<string, unknown>;
+    description?: string | undefined;
+}, {
+    type: "field_restriction" | "row_filter" | "rate_limit" | "time_window" | "anonymization_required" | "audit_required" | "encryption_required";
+    parameters: Record<string, unknown>;
+    description?: string | undefined;
+}>;
+/**
+ * TypeScript type for AccessConstraint
+ */
+export type AccessConstraint = z.infer<typeof AccessConstraintSchema>;
+/**
+ * Data Access Response Schema
+ * @description The response from evaluating a data access request
+ *
+ * @example
+ * ```typescript
+ * const response: DataAccessResponse = {
+ *   allowed: true,
+ *   reason: 'Access granted under GDPR legitimate interest',
+ *   constraints: [
+ *     {
+ *       type: 'anonymization_required',
+ *       parameters: { fields: ['email', 'phone'] },
+ *       description: 'PII fields must be anonymized'
+ *     }
+ *   ],
+ *   ttl: 3600,
+ *   matched_rules: ['rule-1', 'rule-3'],
+ *   decision_id: '550e8400-e29b-41d4-a716-446655440000'
+ * };
+ * ```
+ */
+export declare const DataAccessResponseSchema: z.ZodObject<{
+    /**
+     * Whether access is allowed
+     */
+    allowed: z.ZodBoolean;
+    /**
+     * Human-readable reason for the decision
+     */
+    reason: z.ZodString;
+    /**
+     * Constraints that must be applied if access is allowed
+     */
+    constraints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /**
+         * Type of constraint
+         */
+        type: z.ZodEnum<["field_restriction", "row_filter", "rate_limit", "time_window", "anonymization_required", "audit_required", "encryption_required"]>;
+        /**
+         * Constraint-specific parameters
+         */
+        parameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        /**
+         * Human-readable description
+         */
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "field_restriction" | "row_filter" | "rate_limit" | "time_window" | "anonymization_required" | "audit_required" | "encryption_required";
+        parameters: Record<string, unknown>;
+        description?: string | undefined;
+    }, {
+        type: "field_restriction" | "row_filter" | "rate_limit" | "time_window" | "anonymization_required" | "audit_required" | "encryption_required";
+        parameters: Record<string, unknown>;
+        description?: string | undefined;
+    }>, "many">>;
+    /**
+     * Time-to-live for the access grant in seconds
+     * @description After this period, access must be re-evaluated
+     */
+    ttl: z.ZodOptional<z.ZodNumber>;
+    /**
+     * IDs of rules that matched during evaluation
+     */
+    matched_rules: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Policies that were evaluated
+     */
+    evaluated_policies: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Unique identifier for this decision (for audit trail)
+     */
+    decision_id: z.ZodOptional<z.ZodString>;
+    /**
+     * Confidence score of the decision (0-1)
+     */
+    confidence: z.ZodOptional<z.ZodNumber>;
+    /**
+     * Additional metadata about the decision
+     */
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+    allowed: boolean;
+    constraints: {
+        type: "field_restriction" | "row_filter" | "rate_limit" | "time_window" | "anonymization_required" | "audit_required" | "encryption_required";
+        parameters: Record<string, unknown>;
+        description?: string | undefined;
+    }[];
+    matched_rules: string[];
+    evaluated_policies: string[];
+    metadata?: Record<string, unknown> | undefined;
+    confidence?: number | undefined;
+    ttl?: number | undefined;
+    decision_id?: string | undefined;
+}, {
+    reason: string;
+    allowed: boolean;
+    metadata?: Record<string, unknown> | undefined;
+    confidence?: number | undefined;
+    constraints?: {
+        type: "field_restriction" | "row_filter" | "rate_limit" | "time_window" | "anonymization_required" | "audit_required" | "encryption_required";
+        parameters: Record<string, unknown>;
+        description?: string | undefined;
+    }[] | undefined;
+    ttl?: number | undefined;
+    matched_rules?: string[] | undefined;
+    evaluated_policies?: string[] | undefined;
+    decision_id?: string | undefined;
+}>;
+/**
+ * TypeScript type for DataAccessResponse
+ */
+export type DataAccessResponse = z.infer<typeof DataAccessResponseSchema>;
+/**
+ * Creates a validated DataAccessRequest
+ * @param data - Raw request data
+ * @returns Validated DataAccessRequest
+ * @throws ZodError if validation fails
+ */
+export declare function createDataAccessRequest(data: unknown): DataAccessRequest;
+/**
+ * Creates a validated DataAccessResponse
+ * @param data - Raw response data
+ * @returns Validated DataAccessResponse
+ * @throws ZodError if validation fails
+ */
+export declare function createDataAccessResponse(data: unknown): DataAccessResponse;
+/**
+ * Creates a validated AccessPolicy
+ * @param data - Raw policy data
+ * @returns Validated AccessPolicy
+ * @throws ZodError if validation fails
+ */
+export declare function createAccessPolicy(data: unknown): AccessPolicy;
+/**
+ * Safely parses DataAccessRequest data without throwing
+ * @param data - Raw request data
+ * @returns SafeParseResult containing either the validated data or error details
+ */
+export declare function safeParseDataAccessRequest(data: unknown): z.SafeParseReturnType<unknown, DataAccessRequest>;
+/**
+ * Safely parses DataAccessResponse data without throwing
+ * @param data - Raw response data
+ * @returns SafeParseResult containing either the validated data or error details
+ */
+export declare function safeParseDataAccessResponse(data: unknown): z.SafeParseReturnType<unknown, DataAccessResponse>;
+/**
+ * Safely parses AccessPolicy data without throwing
+ * @param data - Raw policy data
+ * @returns SafeParseResult containing either the validated data or error details
+ */
+export declare function safeParseAccessPolicy(data: unknown): z.SafeParseReturnType<unknown, AccessPolicy>;
+//# sourceMappingURL=data-access.schema.d.ts.map