SRL Variables and Context

Scope roots

Root	Value	Example
`this`	Current rule section or current per-edit entry.	`this.status`
`config`	Normalized configuration for the current execution scope.	`config.firewall.policy`
`global.config`	Explicit device-global configuration.	`global.config.system.global`
`vdoms.<name>.config`	Explicit configuration for a named VDOM.	`vdoms.root.config.system.interface`
`appliance`	Detected platform and runtime context.	`appliance.vendor`

Appliance fields

Path	Output
`appliance.vendor`	Normalized vendor slug, for example `fortinet`.
`appliance.type`	Platform family, for example `fortigate`.
`appliance.hardware`	Detected model/platform text.
`appliance.os`	Detected full OS version.
`appliance.os_major_minor`	Major/minor OS version such as `7.2`.
`appliance.scope`	`global`, `vdom`, or `all`.
`appliance.current_vdom`	Current VDOM name or `global`.
`appliance.vdoms`	Selected VDOM-name list.
`appliance.multi_vdom`	Boolean indicating multiple selected VDOMs.
`appliance.interfaces.<name>.network_type`	Classification for a physical/logical interface or FortiGate zone: `internet`, `external`, `dmz`, `internal`, `restricted`, `undefined`, or `any`. A zone with differently classified members returns a list containing every distinct member classification.
`appliance.interfaces.any.network_type`	Always returns `any`. This is the synthetic metadata entry for policies that use the FortiGate `any` interface.

Variables and dynamic paths

$vdomName = appliance.current_vdom;
$fieldName = "status";
$interfaceName = this.srcintf;

$status = this.$fieldName;
$policy = vdoms.$vdomName.config.firewall.policy.10;
$networkType = appliance.interfaces.$interfaceName.network_type;

Variables begin with $. A variable used as a path segment is resolved at runtime, allowing one rule to inspect multiple VDOMs, sections, fields, or object names.

Use any(appliance.interfaces.$interfaceName.network_type, "internet", "external") for network classification checks. any() accepts both the scalar value returned for an interface or uniform zone and the list returned for a mixed zone.

If a path cannot be resolved, SRL carries an internal unresolved value. Presence functions and operators treat it as missing; text conversion produces an empty string and numeric conversion produces zero.

Annotation metadata

Configuration arrays are internally annotated so functions can recover their source identity without exposing private metadata to loops, counts, keys, or output.

$objectName = name(this);
$objectPath = path(this);
$section = parent(this);

addInfoFinding(
    "Object " + $objectName + " is under " + path($section),
    "Review the object in its source section."
);

array_values(), array_slice(), array_reverse(), and array_group_by() retain annotations on returned configuration objects.