contract PolicyEngine {
    // Policy set storage per account
    mapping(address => PolicySet) public policySets;

    // Register or update a policy set
    function setPolicySet(
        bytes32 policyCID,
        address pkpAddress,
        bytes calldata encodedRules,
        uint8 failMode,
        bool requiresAttestation
    ) external;

    // Remove a policy set
    function removePolicySet() external;

    // Evaluate a transaction against the caller's policy
    function evaluate(
        address target,
        uint256 value,
        bytes calldata data,
        bytes calldata attestation
    ) external returns (bool);
}

struct PolicySet {
    bytes32 policyCID;          // IPFS CID of the full policy
    address pkpAddress;         // PKP address for attestation verification
    bytes encodedRules;         // Compact binary-encoded on-chain rules
    FailMode failMode;          // CLOSED or OPEN
    bool requiresAttestation;   // Whether Tier 3 attestation is required
    bool active;                // Whether the policy is active
}

function setPolicySet(
    bytes32 policyCID,
    address pkpAddress,
    bytes calldata encodedRules,
    uint8 failMode,
    bool requiresAttestation
) external;

function removePolicySet() external;

function evaluate(
    address target,
    uint256 value,
    bytes calldata data,
    bytes calldata attestation
) external returns (bool allowed);

function getPolicySet(address account) external view returns (PolicySet memory);

event PolicySetUpdated(address indexed account, bytes32 policyCID);
event PolicySetRemoved(address indexed account);
event TransactionEvaluated(
    address indexed account,
    address indexed target,
    bool allowed
);

[ruleCount: uint8]
[rule1Type: uint8][rule1DataLength: uint16][rule1Data: bytes]
[rule2Type: uint8][rule2DataLength: uint16][rule2Data: bytes]
...