Get this layer's protection manifest
Returns the team-scope protection spec as authored. Response is content-negotiated — YAML by default, or JSON with Accept: application/json. Pass ?include_composition=true to include the _composition metadata block describing which scopes were merged. Pass ?include=sources (see ADR-053) for the scope-resolution envelope — the contributing layers plus the composed result; the envelope shape is scope-specific. ETag is computed from content_hash (cards-as-primitive Phase 1); If-None-Match returns 304. For the composed view across scopes, use the /effective sub-resource (Wave 2).
Authorizations
Supabase JWT token in Authorization: Bearer header
Headers
Response format. YAML is canonical; JSON is returned only on explicit application/json. The ?include=sources envelope is JSON-only.
text/yaml, application/yaml, application/json Path Parameters
Team identifier (UUID)
Query Parameters
Include the _composition metadata block on the response body.
When sources, returns the scope-resolution envelope for this scope (the contributing layers + the composed result); the envelope shape is scope-specific (see ADR-053). The envelope is JSON-only.
sources Response
Protection manifest at this scope.
Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.
Strictest-wins composition: enforce > nudge > observe > off.
off, observe, nudge, enforce Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].
Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).
Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.
Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.
System-managed block describing which scope sources merged into the canonical card. Only returned when ?include_composition=true.