azure-batch-jobschedule-write

id: azure-batch-jobschedule-write
emits: CanSchedule
match_effective_permission:
  action: Microsoft.Batch/batchAccounts/jobSchedules/write
  data_action: true
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  source: <principal>
  target: <batch job schedule>
  permissions:
  - Microsoft.Batch/batchAccounts/jobSchedules/write
  conditions:
  - service_state
  - trigger_exists
  note: Creates a recurring schedule that submits jobs -> persistence + trigger for task execution on
    the pool.
  false_positive_note: CanSchedule here is persistence / trigger creation only; onward CanExecuteAs still
    requires an identity-bearing pool that has (or can scale) nodes. The schedule fires only when the
    target pool can actually run tasks, so emit CONDITIONAL(service_state, trigger_exists) when the pool
    has zero nodes or no MI.
  narrative: '{principal.name} can create a recurring job schedule (jobSchedules/write) that repeatedly
    runs tasks on Batch nodes.'