policy.mdx

title	Policy
description	Policy protocol schemas

{/* ⚠️ AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs go in content/docs/guides/. */}

Password Complexity Policy

**Source:** `packages/spec/src/security/policy.zod.ts`

TypeScript Usage

import { AuditPolicy, NetworkPolicy, PasswordPolicy, Policy, SessionPolicy } from '@objectstack/spec/security';
import type { AuditPolicy, NetworkPolicy, PasswordPolicy, Policy, SessionPolicy } from '@objectstack/spec/security';

// Validate data
const result = AuditPolicy.parse(data);

---

AuditPolicy

Properties

Property	Type	Required	Description
logRetentionDays	number	✅	[EXPERIMENTAL — not enforced] Days to retain audit logs
sensitiveFields	string[]	✅	[EXPERIMENTAL — not enforced] Fields to redact in logs (e.g. password, ssn)
captureRead	boolean	✅	[EXPERIMENTAL — not enforced] Log read access (High volume!)

---

NetworkPolicy

Properties

Property	Type	Required	Description
trustedRanges	string[]	✅	[EXPERIMENTAL — not enforced] CIDR ranges allowed to access (e.g. 10.0.0.0/8)
blockUnknown	boolean	✅	[EXPERIMENTAL — not enforced] Block all IPs not in trusted ranges
vpnRequired	boolean	✅	[EXPERIMENTAL — not enforced] Require VPN to access

---

PasswordPolicy

Properties

Property	Type	Required	Description
minLength	number	✅	[EXPERIMENTAL — not enforced] Minimum password length
requireUppercase	boolean	✅	[EXPERIMENTAL — not enforced] Require an uppercase letter
requireLowercase	boolean	✅	[EXPERIMENTAL — not enforced] Require a lowercase letter
requireNumbers	boolean	✅	[EXPERIMENTAL — not enforced] Require a number
requireSymbols	boolean	✅	[EXPERIMENTAL — not enforced] Require a symbol
expirationDays	number	optional	[EXPERIMENTAL — not enforced] Force password change every X days
historyCount	number	✅	[EXPERIMENTAL — not enforced] Prevent reusing last X passwords

---

Policy

Properties

Property	Type	Required	Description
name	string	✅	[EXPERIMENTAL — not enforced] Policy Name
password	Object	optional
network	Object	optional
session	Object	optional
audit	Object	optional
isDefault	boolean	✅	[EXPERIMENTAL — not enforced] Apply to all users by default
assignedProfiles	string[]	optional	[EXPERIMENTAL — not enforced] Apply to specific profiles

---

SessionPolicy

Properties

Property	Type	Required	Description
idleTimeout	number	✅	[EXPERIMENTAL — not enforced] Minutes before idle session logout
absoluteTimeout	number	✅	[EXPERIMENTAL — not enforced] Max session duration (minutes)
forceMfa	boolean	✅	[EXPERIMENTAL — not enforced] Require 2FA for all users

---