policy

type Change struct {
	Name   string
	Action string // create, update, unchanged
	Detail string
}

type Desired struct {
	HostTag      string   // e.g. tag:server; empty skips host/tag mutations
	TagOwners    []string // owners of HostTag; default autogroup:admin
	GrantSrc     []string
	GrantDst     []string // svc:name entries
	GrantIP      []string // always 443
	SrcDefaulted bool     // GrantSrc was filled because access.src was empty
}

type Plan struct {
	Changes []Change
}