PowerShell WDAC Policy Script

I need an expert-level PowerShell script that automates creation and deployment of a Windows Defender Application Control (WDAC) policy. The baseline policy must:

• Allow only applications signed by the publishers I will provide during our chat
• Start in AuditOnly mode and capture detailed event data
• Offer a clean switch (parameter or function) that re-deploys the same policy in Enforce mode once I’m ready
• Generate and apply supplemental policies so I can append new trusted publishers later without touching the base policy

Detailed logging is essential: the script should write verbose, timestamped output to both the console and a log file, and surface any errors. Please structure your code so publisher lists can be fed from a simple CSV or JSON, and document each step in comments plus a short README.

Deliverables
1. Well-commented .ps1 script meeting the above criteria
2. Sample data file for publishers
3. README explaining usage, parameters, and the audit-to-enforce transition
4. Confirmation the script runs on Windows 10/11 and Server 2019+ without additional modules beyond what ships with Windows

I’ll supply the full publisher list as soon as we open the chat.
I am not using intune, i want to deploy via powershell only.

I will need to be able to test the script in both audit mode and enforced mode.

Thanks