{
  "id": "m0028",
  "title": "pipeline_tool_policies 工具作用域策略表——五级作用域(global/org/pipeline/role/project)的 allow/deny 微调；新表，配套 models/pipeline_tool_policies.json",
  "backup_tables": [],
  "up": [
    {
      "op": "sql",
      "sql": "CREATE TABLE IF NOT EXISTS pipeline_tool_policies (id varchar(32) NOT NULL, scope varchar(32) NOT NULL DEFAULT 'org', scope_id varchar(128) NOT NULL DEFAULT '', tool_name varchar(64) NOT NULL, effect varchar(16) NOT NULL DEFAULT 'allow', reason varchar(500) DEFAULT NULL, status varchar(16) NOT NULL DEFAULT 'active', created_by varchar(32) DEFAULT NULL, created_at datetime NOT NULL DEFAULT current_timestamp(), updated_at datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(), PRIMARY KEY (id), UNIQUE KEY uk_scope_tool (scope, scope_id, tool_name), KEY idx_scope (scope, scope_id, status)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
    }
  ],
  "down": [
    {
      "op": "sql",
      "sql": "DROP TABLE IF EXISTS pipeline_tool_policies"
    }
  ]
}