# policy/openshell/overlays/quickbooks.yaml
# QuickBooks Online policy overlay (applied at S7 when QBO is connected).
#
# Allows the sandbox to reach QuickBooks Online APIs for read operations
# (reports, search, get). Write/update/delete operations are excluded
# at the MCP tool level.
#
# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes

preset:
  name: quickbooks-online
network_policies:
  quickbooks-online:
    name: quickbooks-online
    endpoints:
      - host: quickbooks.api.intuit.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: /**
          - allow:
              method: POST
              path: /**
      - host: oauth.platform.intuit.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: POST
              path: /**
    binaries:
      - path: /usr/local/bin/hermes
      - path: /usr/bin/python3*
      - path: /opt/hermes/.venv/bin/python