# Policy
## Properties
Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
**triggerables** | Option<[**std::collections::HashMap<String, serde_json::Value>**](serde_json::Value.md)> | | [optional]
**triggerables_v2** | Option<[**std::collections::HashMap<String, serde_json::Value>**](serde_json::Value.md)> | | [optional]
**s3_inputs** | Option<[**Vec<serde_json::Value>**](serde_json::Value.md)> | | [optional]
**allowed_s3_keys** | Option<[**Vec<models::PolicyAllowedS3KeysInner>**](Policy_allowed_s3_keys_inner.md)> | | [optional]
**execution_mode** | Option<**String**> | | [optional]
**on_behalf_of** | Option<**String**> | | [optional]
**on_behalf_of_email** | Option<**String**> | | [optional]
**sandbox** | Option<**bool**> | Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior). | [optional]
**frontend_sdk_scopes** | Option<**Vec<String>**> | Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read). | [optional]
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)