# Policy
## Properties
Name | Type | Description | Notes
------------ | ------------- | ------------- | -------------
**triggerables** | Option<[**std::collections::HashMap<String, serde_json::Value>**](serde_json::Value.md)> | | [optional]
**triggerables_v2** | Option<[**std::collections::HashMap<String, serde_json::Value>**](serde_json::Value.md)> | | [optional]
**s3_inputs** | Option<[**Vec<serde_json::Value>**](serde_json::Value.md)> | | [optional]
**allowed_s3_keys** | Option<[**Vec<models::PolicyAllowedS3KeysInner>**](Policy_allowed_s3_keys_inner.md)> | | [optional]
**execution_mode** | Option<**String**> | Who may open the app, and who its runnables execute as. Optional, and what omitting it means depends on the operation: creating an app defaults it to `publisher` (runs on behalf of the app's publisher and requires an authenticated viewer), while updating one keeps the mode the app is already deployed under. Neither `anonymous`, which makes the app publicly executable, nor `guest`, which opens it to anyone the identity provider authenticates, is ever assumed. A guest is only admitted where the workspace also has `guest_access_enabled`, which is checked when the session is minted and again on every guest request | [optional]
**on_behalf_of** | Option<**String**> | The user or group the app runs as in anonymous or publisher mode (e.g. 'u/admin' or 'g/mygroup'). The authority for the app's identity. | [optional]
**on_behalf_of_email** | Option<**String**> | Address of `on_behalf_of`, written through from it on every save and returned as stored. Optional; when absent it is derived from `on_behalf_of`. Sending it is optional too; it must name the same account as `on_behalf_of`, and a pair that disagrees is rejected. | [optional]
**sandbox** | Option<**bool**> | Publisher opt-in to app sandbox isolation (alpha). When true the app is isolated from each viewer's Windmill session. When false/absent the app runs same-origin with the viewer's full session (the default, pre-isolation behavior). | [optional]
**frontend_sdk_scopes** | Option<**Vec<String>**> | Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read, flow_conversations:read, flow_conversations:write). | [optional]
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)