Create a pull request in PowerShell/PowerShell (base: master) that adds the new GitHub policy file below.

File to add

Path: .github/policies/labelAdded.approvedLowRisk.yml

Contents:

id: labelAdded.approvedLowRisk
name: GitOps.PullRequestIssueManagement
description: Remove Approved-LowRisk if applied by an unauthorized user
owner:
resource: repository
disabled: false
where:
configuration:
  resourceManagementConfiguration:
    eventResponderTasks:
      - description: Remove Approved-LowRisk if label was added by someone not authorized
        if:
          - payloadType: Pull_Request
          - isOpen
          - labelAdded:
              label: Approved-LowRisk
          # Unauthorized = NOT admin/write AND NOT in explicit allowlist
          - not:
              or:
                - activitySenderHasPermission:
                    permission: Admin
                - activitySenderHasPermission:
                    permission: Write

                # Allowlist (enabled)
                - isActivitySender:
                    user: iSazonov
                    issueAuthor: False
                - isActivitySender:
                    user: daxian-dbw
                    issueAuthor: False

                # Allowlist (commented out for now)
                # - isActivitySender:
                #     user: TravisEz13
                #     issueAuthor: False
                # - isActivitySender:
                #     user: adityapatwardhan
                #     issueAuthor: False
                # - isActivitySender:
                #     user: jshigetomi
                #     issueAuthor: False
        then:
          - removeLabel:
              label: Approved-LowRisk
          - addReply:
              reply: >-
                The `Approved-LowRisk` label is restricted to authorized maintainers and was removed.
onFailure:
onSuccess:

Acceptance criteria

• Add the file exactly as specified.
• Ensure YAML formatting/indentation is valid.
• Open a PR titled "Add policy to restrict Approved-LowRisk label".