Composition Combines Evaluation Results, Not Property Maps

Specification scope: Core with the Validation and Conditional Composition companion specifications.

Composition evaluates one complete instance against each branch. It does not merge the branches into one property map. Treating it as a merge changes the policy being expressed.

The composition operator combines the true-or-false results. One access request is enough to show how allOf, anyOf, oneOf, and not reduce those results.

A complete policy

The base shape requires a subject, an action, a resource, and authentication methods. The composition constraints add policy:

{
  "$schema": "https://json-structure.org/meta/validation/v0/#",
  "$id": "https://schemas.example.com/access-request",
  "name": "AccessRequest",
  "type": "object",
  "properties": {
    "subject": { "type": "string" },
    "action": { "type": "string" },
    "resource": { "type": "string" },
    "authMethods": {
      "type": "set",
      "items": { "type": "string" }
    },
    "breakGlassReason": { "type": "string" }
  },
  "required": ["subject", "action", "resource", "authMethods"],
  "additionalProperties": false,
  "allOf": [
    {
      "not": {
        "properties": {
          "subject": { "type": "string", "const": "anonymous" }
        },
        "required": ["subject"]
      }
    },
    {
      "anyOf": [
        {
          "properties": {
            "authMethods": {
              "type": "set",
              "contains": { "type": "string", "const": "mfa" }
            }
          }
        },
        {
          "properties": {
            "authMethods": {
              "type": "set",
              "contains": { "type": "string", "const": "hardware-key" }
            }
          }
        }
      ]
    },
    {
      "oneOf": [
        {
          "properties": {
            "action": { "type": "string", "const": "read" }
          },
          "required": ["action"]
        },
        {
          "properties": {
            "action": { "type": "string", "const": "write" },
            "breakGlassReason": { "type": "string", "minLength": 10 }
          },
          "required": ["action", "breakGlassReason"]
        }
      ]
    }
  ]
}

A write request satisfying the policy is:

{
  "subject": "operator-42",
  "action": "write",
  "resource": "plant/7/controller",
  "authMethods": ["password", "hardware-key"],
  "breakGlassReason": "Emergency valve correction"
}

Read the match counts

allOf requires every member to evaluate true. Here all three members must pass: the subject exclusion, the strong-authentication rule, and the action rule. allOf does not merge the members before evaluation; contradictory members simply make the combined constraint impossible to satisfy.

anyOf requires at least one match. A request may contain mfa, hardware-key, or both. Two matches are valid here; oneOf would reject them.

oneOf requires exactly one match. The const values make the read and write branches disjoint, so an action cannot satisfy both. The write branch also requires a breakGlassReason of at least ten characters. If branches overlap accidentally, an instance matching two branches fails even when each branch looks acceptable alone.

not inverts one subschema result. The request passes that constraint when the anonymous-subject schema fails. It contributes no replacement type or affirmative shape; it only excludes a matching region.

Closed objects belong outside the branches

The base object owns additionalProperties: false. Putting a closed-object rule into each partial branch would make sibling properties appear illegal. Composition evaluates complete instances against each member, so partial policy overlays remain open in this pattern. The stable structural schema defines the closed member set.

The draft requires non-empty type-union arrays for allOf, anyOf, and oneOf; not takes one schema, which may itself be a type union. Array order does not change the truth conditions.

Current meta-schema support

The draft calls the feature JSONSchemaConditionalComposition, while the meta-schema offers JSONStructureConditionalComposition. The validation meta-schema used above enables the repository name. The validation draft also permits const inside contains, which gives the authentication checks their fixed values.

Core already defines const, and the validation add-in defines minLength. The checked-in extended meta-schema, however, omits contains and gives the composition members shapes that differ from the draft text. A draft-conforming evaluator can apply this policy, but meta-schema validation may stop at either discrepancy.