brand.json: add structural category restrictions and jurisdiction fields

[kapoost]

Problem

brand.json currently captures brand identity (logo, colors, portfolio architecture) but has no mechanism for structural category restrictions that are inherent to the brand — not campaign-specific.

Motivation

Some restrictions are permanent attributes of a brand, not governance configurations per campaign:

• A firearms brand (e.g. category: weapons) should never appear in jurisdictions where sale/promotion is prohibited
• Alcohol brands should not reach users in certain religious/cultural contexts, or users actively in recovery
• These are not campaign-level decisions — they are brand-level facts

Currently, these must be re-declared in every governance agent configuration. This creates risk: a misconfigured campaign could bypass restrictions that should be structurally impossible to bypass.

Proposed change

Add optional fields to the brand object in brand.json:

{
  "category_restrictions": {
    "iab_categories": ["IAB8-5"],
    "restricted_jurisdictions": ["SA", "IR", "PK"],
    "age_restricted": true,
    "sensitive_category": "alcohol"
  }
}

This would allow buyer agents encountering an unknown brand to immediately know structural constraints without querying a governance agent — reducing token waste and preventing fires in markets that didn't invite the torch.

Affected files

• brand.json schema
• Governance docs (reference to structural vs campaign-level restrictions)

Related

• 3.1 scoping: GDPR Article 22 explicit signaling for automated decisions #2394 (GDPR Art. 22), Consent-scope propagation across protocol boundaries #2540 (consent-scope)