1 files changed, 21 insertions, 0 deletions
diff --git a/src/zenhttp/include/zenhttp/localrefpolicy.h b/src/zenhttp/include/zenhttp/localrefpolicy.h
new file mode 100644
index 000000000..0b37f9dc7
--- /dev/null
+++ b/src/zenhttp/include/zenhttp/localrefpolicy.h
@@ -0,0 +1,21 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <filesystem>
+
+namespace zen {
+
+/// Policy interface for validating local file reference paths in inbound CbPackage messages.
+/// Implementations should throw std::invalid_argument if the path is not allowed.
+class ILocalRefPolicy
+{
+public:
+	virtual ~ILocalRefPolicy() = default;
+
+	/// Validate that a local file reference path is allowed.
+	/// Throws std::invalid_argument if the path escapes the allowed root.
+	virtual void ValidatePath(const std::filesystem::path& Path) const = 0;
+};
+
+}  // namespace zen