{
    security_policy: {
        job_policy: {
            ambient_mark_vmo_exec: [
                "/core/appmgr",
                "/core/test_manager/elf_test_ambient_exec_runner",

                // The v2 Flutter and Dart JIT runners (which are not used for
                // release builds) execute VMOs in order to run Flutter and
                // Dart components.
                // TODO(fxb/88626): These runners are configured in
                // experiences.git (a product) and references to them do not
                // belong in fuchsia.git (the platform). Add support for
                // per-product policies and remove the runners from here.
                "/core/session-manager/session:session/dart_jit_runner",
                "/core/session-manager/session:session/flutter_jit_runner",
                "/core/session-manager/session:session/workstation_session/login_shell/ermine_shell/chrome",

                // FOR _ENG BUILDS ONLY: We allow elements in the Workstation
                // session to access ambient accessibility to develop
                // runnerless Flutter apps using JIT compilation (which enables hot
                // reload). This should never be exposed to release builds, which
                // should use AOT compilation instead.
                "/core/session-manager/session:session/workstation_session/login_shell/ermine_shell/element_manager/elements:**",

                // We allow tests to access ambient executability in the same
                // way that we're permissive with use of the components v1
                // deprecated-ambient-replace-as-executable feature and
                // VmexResource protocol on eng builds.
                "/core/test_manager/dart_aot_runner",
                "/core/test_manager/dart_jit_runner",
                "/core/test_manager/system-tests:**",
            ],
            main_process_critical: [
                "/bootstrap/archivist",
                "/bootstrap/driver_manager",
                "/bootstrap/fshost",
                "/bootstrap/power_manager",
                "/bootstrap/shutdown_shim",
            ],
            create_raw_processes: [
                "/core/starnix_manager/starmium",
                "/core/starnix_manager/stardroid",
                "/core/starnix_manager/starless",
                "/core/test_manager/starnix_test_runners/starnix_unit_test_runner",
                "/core/test_manager/starnix-tests:**",
            ],
        },
        capability_policy: [
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.boot.RootResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/driver_manager",

                    // Driver component names vary depending on the
                    // exact hardware configuration of the board.
                    // Grant all drivers the ability to access the root
                    // resource because of this.
                    // TODO(fxbug.dev/93188): remove this once the root
                    // resource is not widely used.
                    "/bootstrap/boot-drivers:**",
                    "/bootstrap/pkg-drivers:**",
                    "/bootstrap/netsvc",
                    "/bootstrap/svchost",
                    "/core",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.CpuResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/power_manager",
                    "/core",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.DebugResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console",
                    "/core",
                    "/core/debug_serial",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.HypervisorResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/zircon-guest-manager/vmm",
                    "/core/debian-guest-manager/vmm",
                    "/core/termina-guest-manager/vmm",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.InfoResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.IoportResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.IrqResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/zircon-guest-manager/vmm",
                    "/core/debian-guest-manager/vmm",
                    "/core/termina-guest-manager/vmm",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.RootJob",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/driver_manager",
                    "/bootstrap/netsvc",
                    "/bootstrap/pwrbtn-monitor",
                    "/bootstrap/svchost",
                    "/core",
                    "/core/debug_agent",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.RootJobForInspect",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/netsvc",
                    "/core",
                    "/core/memory_monitor",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.MmioResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/zircon-guest-manager/vmm",
                    "/core/debian-guest-manager/vmm",
                    "/core/termina-guest-manager/vmm",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.PowerResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/thermd",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.SmcResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/core",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "<component_manager>",
                source: "component",
                source_name: "fuchsia.kernel.VmexResource",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/fshost/blobfs",
                    "/core",
                    "/core/zircon-guest-manager/vmm",
                    "/core/debian-guest-manager/vmm",
                    "/core/termina-guest-manager/vmm",
                    "/core/starnix_manager/starmium",
                    "/core/starnix_manager/stardroid",
                    "/core/starnix_manager/starless",
                    "/core/test_manager/starnix_test_runners/starnix_unit_test_runner",
                    "/core/test_manager/starnix-tests:**",
                    "/core/test_manager/system-tests:**",
                ],
            },
            {
                source_moniker: "/bootstrap/fshost",
                source: "component",
                source_name: "blob",
                capability: "directory",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/fshost",
                    "/core",
                    "/core/appmgr",
                    "/core/pkg-cache",
                ],
            },
            {
                source_moniker: "/bootstrap/fshost",
                source: "component",
                source_name: "minfs",
                capability: "directory",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/fshost",
                    "/core",
                    "/core/appmgr",
                    "/core/minfs",
                    "/core/ssh-key-manager",
                    "/core/sshd-host",

                    // TODO(https://fxbug.dev/98760): Remove once fixed.
                    "/core/sl4f",
                ],
            },
            {
                source_moniker: "/bootstrap/fshost",
                source: "component",
                source_name: "tmp",
                capability: "directory",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/fshost",
                    "/bootstrap/netsvc",
                    "/core",
                    "/core/appmgr",
                    "/core/sshd-host",

                    // TODO(https://fxbug.dev/98755): Remove once https://fxbug.dev/86575 is fixed.
                    "/core/sl4f",
                ],
            },
            {
                source_moniker: "/bootstrap/fshost",
                source: "component",
                source_name: "deprecated-misc-storage",
                capability: "directory",
                target_monikers: [
                    "/bootstrap/fshost",
                    "/core/system-updater",
                    "/core/system-update-checker",
                ],
            },
            {
                source_moniker: "/bootstrap/fshost/blobfs",
                source: "component",
                source_name: "blob-exec",
                capability: "directory",
                target_monikers: [
                    "/bootstrap/fshost",
                    "/bootstrap/fshost/blobfs",
                    "/bootstrap/pkg-cache",
                    "/bootstrap/pkg_cache_resolver",
                ],
            },
            {
                // We restrict access to PackageResolver because it gives direct access to package
                // handles which provide executability which bypass VX security policy.
                source_moniker: "/core/pkg-resolver",
                source: "component",
                source_name: "fuchsia.pkg.PackageResolver",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",

                    // This is only used when the kernel commandline flag devmgr.enable-ephemeral
                    // is set, which enables loading drivers ephemerally. This is intended for
                    // eng builds only.
                    "/bootstrap/driver_index",
                    "/bootstrap/driver_manager",
                    "/bootstrap/full_resolver",
                    "/bootstrap/netsvc",

                    // system-updater still runs as a v1 component and is a
                    // valid client of PackageResolver.  appmgr has its own
                    // allowlist for v1 components accessing pkg-resolver.
                    "/core",
                    "/core/full-resolver",
                    "/core/universe-resolver",
                    "/core/system-update-checker",
                    "/core/system-updater",
                ],
            },
            {
                // We restrict access to PackageCache because it gives direct access to package
                // handles which provide executability which bypass VX security policy.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "fuchsia.pkg.PackageCache",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap/base_resolver",
                    "/core",
                    "/core/pkg-resolver",
                    "/core/system-updater",
                ],
            },
            {
                // We restrict access to RetainedPackages because it gives callers the ability
                // to override certain package garbage collection behavior intended to only be
                // used by the system updater.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "fuchsia.pkg.RetainedPackages",
                capability: "protocol",
                target_monikers: [
                    "/core/system-updater",
                ],
            },
            {
                // We restrict access to PackageCache because it gives direct access to executable
                // binaries.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "bin",
                capability: "directory",
                target_monikers: [
                    "/bootstrap/console-launcher",
                    "/core/sshd-host",
                ],
            },
            {
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "build-info",
                capability: "directory",
                target_monikers: [
                    "/core/build-info",
                    "/core/feedback",
                    "/core/omaha-client-service",
                    "/core/sshd-host",
                    "/core/system-updater",

                    // TODO(fxbug.dev/91934): Once we can define test realms out of tree
                    // we should remove this.
                    "/core/test_manager/chromium-tests:**",
                ],
            },
            {
                // We restrict access to pkgfs because it gives direct access to executable package
                // handles.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "pkgfs",
                capability: "directory",
                target_monikers: [
                    "/bootstrap/console-launcher",
                    "/bootstrap/driver_manager",
                    "/core",
                    "/core/appmgr",
                    "/core/sshd-host",
                ],
            },
            {
                // We restrict access to pkgfs-packages because it gives direct access to
                // executable package handles.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "pkgfs-packages",
                capability: "directory",
                target_monikers: [
                    "/bootstrap/base_resolver",
                    "/bootstrap/driver_index",
                ],
            },
            {
                // We restrict access to pkgfs-versions because it gives direct access to
                // executable package handles.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "pkgfs-versions",
                capability: "directory",
                target_monikers: [
                    // TODO(fxbug.dev/99692) migrate clients of "pkgfs" to just the subdirectories
                ],
            },
            {
                // We restrict access to system because it gives direct access to executable
                // binaries.
                source_moniker: "/bootstrap/pkg-cache",
                source: "component",
                source_name: "system",
                capability: "directory",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/console-launcher",
                    "/bootstrap/driver_manager",
                    "/core",
                    "/core/appmgr",
                    "/core/sshd-host",
                    "/core/system-updater",
                    "/core/system-update-checker",
                ],
            },
            {
                // We restrict access to base-resolver's ComponentResolver protocol because we
                // expect only parts of component framework to be able to access it.
                source_moniker: "/bootstrap/base-resolver",
                source: "component",
                source_name: "fuchsia.component.resolution.Resolver",
                capability: "protocol",
                target_monikers: [
                    "/core/full-resolver",
                ],
            },

            // Only route Component resolver to test manager and system tests.
            // TODO(fxbug.dev/86464): Remove this once we have facet API
            {
                source_moniker: "/core/full-resolver",
                source: "component",
                source_name: "fuchsia.component.resolution.Resolver",
                capability: "protocol",
                target_monikers: [
                    "/core/test_manager",
                    "/core/test_manager/system-tests:**",
                    "/core/full-resolver",
                ],
            },

            //TODO(fxbug.dev/91765) - Remove source moniker after from target.
            {
                source_moniker: "/bootstrap/cr50_agent",
                source: "component",
                source_name: "fuchsia.tpm.cr50.PinWeaver",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/cr50_agent",
                    "/core",
                    "/core/account",
                    "/core/account/credential_manager",
                ],
            },

            //TODO(fxbug.dev/91765) - Remove source moniker after from target.
            {
                source_moniker: "/bootstrap/cr50_agent",
                source: "component",
                source_name: "fuchsia.tpm.cr50.Cr50",
                capability: "protocol",
                target_monikers: [
                    "/bootstrap",
                    "/bootstrap/cr50_agent",
                    "/bootstrap/console-launcher",
                    "/bootstrap/miscsvc",
                    "/core",
                    "/core/appmgr",
                ],
            },

            // TODO(fxbug.dev/91765) - Remove source moniker after from target.
            {
                source_moniker: "/core/account/credential_manager",
                source: "component",
                source_name: "fuchsia.identity.credential.Manager",
                capability: "protocol",
                target_monikers: [
                    "/core/account/credential_manager",
                    "/core/account/password_authenticator",
                ],
            },

            // TODO(https://fxbug.dev/91765)
            {
                source_moniker: "/core/account/password_authenticator",
                source: "component",
                source_name: "fuchsia.identity.account.AccountManager",
                capability: "protocol",
                target_monikers: [
                    "/core",
                    "/core/account",
                    "/core/account/password_authenticator",
                    "/core/session-manager/session:session",
                    "/core/session-manager/session:session/workstation_session",
                    "/core/session-manager/session:session/workstation_session/login_shell",
                ],
            },

            // TODO(https://fxbug.dev/93790): not security policy; split out into separate file.
            // TODO(https://fxbug.dev/93579): once product assembly supports product-specific
            // components running in the network realm, remove this policy.
            {
                source_moniker: "/core/network/netstack",
                source: "component",
                source_name: "fuchsia.posix.socket.raw.Provider",
                capability: "protocol",
                target_monikers: [
                    "/core/network",
                    "/core/network/netstack",
                    "/core/lowpan-ot-driver",
                ],
            },
            {
                source_moniker: "/core/lowpanservice",
                source: "component",
                source_name: "fuchsia.factory.lowpan.FactoryLookup",
                capability: "protocol",
                target_monikers: [
                    "/core",
                    "/core/appmgr",
                    "/core/lowpanservice",
                ],
            },
            {
                source_moniker: "/core/lowpanservice",
                source: "component",
                source_name: "fuchsia.lowpan.device.DeviceExtraConnector",
                capability: "protocol",
                target_monikers: [
                    "/core",
                    "/core/appmgr",
                    "/core/lowpanservice",
                ],
            },
            {
                source_moniker: "/core/lowpanservice",
                source: "component",
                source_name: "fuchsia.lowpan.device.DeviceRouterExtraConnector",
                capability: "protocol",
                target_monikers: [
                    "/core",
                    "/core/appmgr",
                    "/core/lowpanservice",
                ],
            },
        ],
        child_policy: {
            reboot_on_terminate: [
                "/bootstrap/driver_index",
                "/core",
                "/core/appmgr",
                "/core/audio_core",
                "/core/network/netstack",
                "/core/omaha-client-service",
                "/core/setui_service",
                "/core/sysmem_connector",
                "/core/system-update-checker",
                "/core/system-update-committer",
                "/core/wlancfg",
                "/core/wlandevicemonitor",
                "/core/wlanstack",
            ],
        },
        debug_registration_policy: [
            {
                debug: "protocol",
                environment_name: "test-env",
                source_moniker: "/core/test_manager/debug_data",
                source_name: "fuchsia.debugdata.Publisher",
                target_moniker: "/core/test_manager",
            },
            {
                debug: "protocol",
                environment_name: "legacy-test-env",
                source_moniker: "/core/test_manager/debug_data",
                source_name: "fuchsia.debugdata.Publisher",
                target_moniker: "/core/test_manager",
            },
        ],
    },
}