# description
Either edge TLS policy (scope: edge — public-facing protocol/HSTS/CSP) or internal transport security (scope: internal — sidecar channels, NATS/Redis posture). Discriminated by `scope`.

# $comment
Discriminated-union shape — strictness lives in each `oneOf` branch via `additionalProperties: false`. Setting it at root would reject the per-scope keys defined only inside the matching branch.