{
  "context": "Evaluates whether the agent implements a correct Gatekeeper ConstraintTemplate Rego policy using the violation rule, input.review.object for the resource, and input.parameters for constraint configuration.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "violation contains msg pattern",
      "description": "The policy uses `violation contains {\"msg\": msg} if { ... }` (Gatekeeper pattern), not `deny contains msg`",
      "max_score": 34
    },
    {
      "name": "Uses input.review.object",
      "description": "The policy reads the resource from `input.review.object` (Gatekeeper), not `input.request.object` (kube-mgmt)",
      "max_score": 26
    },
    {
      "name": "Uses input.parameters for required labels",
      "description": "The required labels are read from `input.parameters` rather than hardcoded in the policy",
      "max_score": 27
    },
    {
      "name": "Tests pass",
      "description": "All tests pass when running `opa test . -v`",
      "max_score": 13
    }
  ]
}