-- Which guard policies apply where: a policy from server.yaml's library,
-- attached to an organization, team, project, user or key. Everything below
-- an attachment is judged by it too.
CREATE TABLE guard_attachments (
  scope    TEXT NOT NULL,
  scope_id TEXT NOT NULL,
  policy   TEXT NOT NULL,
  added_at INTEGER NOT NULL,
  added_by TEXT NOT NULL DEFAULT '',
  PRIMARY KEY (scope, scope_id, policy)
);