Plan: Windows Information Protection (WIP) Policies (029)

Branch: feat/029-wip-policies
Date: 2026-01-04
Input: spec.md

Approach

Confirm Graph behavior:
- endpoints for both WIP collections
- assignment endpoints (list + assign/create shape)
- patchable/read-only fields and required permissions
Add new types to config/tenantpilot.php (category “Apps/MAM”, platform windows, restore mode/risk).
Add graph contracts in config/graph_contracts.php:
- resource paths
- type families
- assignment endpoints
Ensure restore uses the derived entity set endpoint (do not PATCH generic managedAppPolicies/{id} when Graph requires derived resources).
Add a normalizer for readable UI output.
Add targeted Pest coverage.

Restore mode: default preview-only until endpoint + assignment behavior is confirmed with tests and real tenants.