scan

const (
	// ActionAllow means no scan rule matched.
	ActionAllow Action = "allow"
	// ActionAnnotate means the content may continue with a safe policy note.
	ActionAnnotate Action = "annotate"
	// ActionReject means the content must not be persisted.
	ActionReject Action = "reject"
)

const (
	// CategoryThreat covers prompt-injection, exfiltration, and persistence payloads.
	CategoryThreat Category = "threat"
	// CategoryWhatNotToSave covers Slice 1 persistence denylist policy.
	CategoryWhatNotToSave Category = "what_not_to_save"
	// CategoryAnnotation covers non-blocking policy hints for later controller tasks.
	CategoryAnnotation Category = "annotation"
)