[
  {
    "Name": "SpendPilot Azure remediation (approve-then-delete)",
    "IsCustom": true,
    "Description": "Least-privilege deletes for SpendPilot approve-then-delete: unattached managed disks and unused public IPs only. Does not allow VM delete.",
    "Actions": [
      "Microsoft.Compute/disks/delete",
      "Microsoft.Compute/disks/read",
      "Microsoft.Network/publicIPAddresses/delete",
      "Microsoft.Network/publicIPAddresses/read",
      "Microsoft.Resources/subscriptions/resourceGroups/read"
    ],
    "NotActions": [],
    "DataActions": [],
    "NotDataActions": [],
    "AssignableScopes": [
      "/subscriptions/{subscriptionId}"
    ]
  }
]