# Plan: Policy Sets (Intune native bundling) (025)

**Branch**: `feat/025-policy-sets`  
**Date**: 2026-01-04  
**Input**: [spec.md](./spec.md)

## Approach
1. Confirm Graph API surface:
   - resource: `deviceAppManagement/policySets`
   - item model + subresource path (`/policySets/{id}/items`)
   - assignments subresource (`/policySets/{id}/assignments`)
2. Add `policySet` to `config/tenantpilot.php` (category “Apps/MAM”, risk, restore mode).
3. Add contract entry in `config/graph_contracts.php`:
   - resource + type family
   - member hydration strategy for items (subresource)
   - assignments CRUD paths (if supported)
4. Extend snapshot capture to hydrate `items` (and assignments).
5. Implement restore preview “linking report”:
   - identify referenced object IDs inside items
   - attempt mapping by (type, displayName, externalId) where possible
   - surface missing dependencies and block execution by default
6. Add targeted Pest tests for sync + snapshot hydration + preview report.

## Decisions / Notes
- **Restore mode**: default `preview-only` until a robust cross-tenant linking/mapping strategy exists.
- Policy Sets are not “settings restore”; they are primarily a **relationship/linking** restore step.