{
  "auditSchemaVersion": 1,
  "type": "vfs_policy",
  "ts": 1710000000000,
  "sessionId": "example-session",
  "path": "/etc/shadow",
  "effect": "deny",
  "detail": { "ruleId": "boot-policy-deny-vfs" }
}