from dataclasses import dataclass
from enum import IntEnum, StrEnum


class AutonomyLevel(IntEnum):
    DISABLED = 0
    OBSERVE = 1
    DRAFT = 2
    APPROVAL_REQUIRED = 3
    CONTROLLED_AUTONOMOUS = 4
    AUTONOMOUS = 5


class Risk(StrEnum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"


class Decision(StrEnum):
    DENY = "deny"
    DRAFT_ONLY = "draft_only"
    REQUIRE_APPROVAL = "require_approval"
    ALLOW = "allow"


@dataclass(frozen=True, slots=True)
class ActionRequest:
    permission: str
    risk: Risk
    is_write: bool


def evaluate_action(action: ActionRequest, autonomy: AutonomyLevel,
                    granted_permissions: set[str]) -> Decision:
    """Fail closed; high-risk actions always require explicit approval."""
    if autonomy == AutonomyLevel.DISABLED or action.permission not in granted_permissions:
        return Decision.DENY
    if autonomy == AutonomyLevel.OBSERVE and action.is_write:
        return Decision.DENY
    if autonomy == AutonomyLevel.DRAFT and action.is_write:
        return Decision.DRAFT_ONLY
    if action.risk == Risk.HIGH:
        return Decision.REQUIRE_APPROVAL
    if action.is_write and autonomy < AutonomyLevel.CONTROLLED_AUTONOMOUS:
        return Decision.REQUIRE_APPROVAL
    return Decision.ALLOW