{
  "schema": "SEC012_LOCAL_KEY_BOUNDARY_POLICY_v1",
  "local_only": true,
  "production_proof": false,
  "real_key_material": false,
  "custom_crypto": false,
  "contexts": {
    "primary_database": {
      "data_class": "primary_db_record",
      "storage_boundary": "store:primary-db",
      "ciphertext_location": "object:primary-001",
      "key_handle": "dek-primary-v2",
      "kek_authority": "authority:kek-primary",
      "authorized_workloads": [
        "service:primary-api"
      ],
      "key_storage_model": "separate_key_authority",
      "same_compromise_path": false,
      "current_key_id": "dek-primary-v2",
      "historical_key_ids": [
        "dek-primary-v1"
      ],
      "recovery_required": true,
      "recovery_metadata": "plan:primary-recovery"
    },
    "backup_archive": {
      "data_class": "backup_archive",
      "storage_boundary": "store:backup-archive",
      "ciphertext_location": "object:backup-001",
      "key_handle": "dek-backup-v1",
      "kek_authority": "authority:kek-backup",
      "authorized_workloads": [
        "service:backup-recovery"
      ],
      "key_storage_model": "separate_key_authority",
      "same_compromise_path": false,
      "current_key_id": "dek-backup-v1",
      "historical_key_ids": [],
      "recovery_required": true,
      "recovery_metadata": "plan:backup-recovery"
    }
  },
  "forbidden_key_storage_models": [
    "application_source",
    "ordinary_config",
    "version_control"
  ],
  "rotation": {
    "historical_path_must_be_accounted": true,
    "universal_cryptoperiod": false
  },
  "evidence": {
    "real_key_material_forbidden": true,
    "production_proof": false
  }
}