access-engine/examples/informed-decision-sitting/attribute_admission_v8.json

{
  "policy_id": "informed-decision.compact-sitting",
  "policy_version": "v11",
  "note": "Offline request/response fixtures. Shipped admitted sets are empty, so attribute_eligible is not in this file. An allow here is an exact-record pin, not proof of a live approval.",
  "cases": [
    {
      "id": "exact-record-allow",
      "kind": "exact",
      "assurance": "now",
      "expect": {"effect": "allow", "reason": "operator_admitted_compact_sitting"},
      "request": {
        "id": "exact-record-allow",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "accept",
        "resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "memo_version": 1,
          "approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
          "approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "exact-record-wrong-digest",
      "kind": "exact",
      "assurance": "now",
      "expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
      "request": {
        "id": "exact-record-wrong-digest",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "accept",
        "resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "memo_version": 1,
          "approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
          "approval_binding_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "exact-record-with-attribute-context",
      "kind": "attribute",
      "assurance": "now",
      "expect": {"effect": "allow", "reason": "operator_admitted_compact_sitting"},
      "request": {
        "id": "exact-record-with-attribute-context",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "read",
        "resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": true,
          "memo_version": 1,
          "approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
          "approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "exact-pin-mismatch-not-rescued",
      "kind": "attribute",
      "assurance": "now",
      "expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
      "request": {
        "id": "exact-pin-mismatch-not-rescued",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "accept",
        "resource": {"id": "memo:infd-20260927-b02", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": true,
          "memo_version": 1,
          "approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
          "approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "attribute-unknown-class",
      "kind": "attribute",
      "assurance": "now",
      "expect": {"effect": "deny", "reason": "unknown_class"},
      "request": {
        "id": "attribute-unknown-class",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "decline",
        "resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": true,
          "memo_version": 1,
          "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
          "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "attribute-stale-mfa",
      "kind": "attribute",
      "assurance": "stale",
      "expect": {"effect": "deny", "reason": "stale_mfa"},
      "request": {
        "id": "attribute-stale-mfa",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "accept",
        "resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": false,
          "memo_version": 1,
          "approval_id": "not-a-uuid",
          "approval_binding_digest": "sha256:wrong"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "attribute-review-group",
      "kind": "attribute",
      "assurance": "now",
      "expect": {"effect": "deny", "reason": "review_group_not_verified"},
      "request": {
        "id": "attribute-review-group",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["other-group"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "discuss",
        "resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": true,
          "memo_version": 2,
          "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
          "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "attribute-bad-memo-id",
      "kind": "attribute",
      "assurance": "now",
      "expect": {"effect": "deny", "reason": "resource_refused"},
      "request": {
        "id": "attribute-bad-memo-id",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "return",
        "resource": {"id": "memo:NO", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": true,
          "memo_version": 1,
          "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
          "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
        },
        "policy_version": "v8"
      }
    },
    {
      "id": "attribute-list-stays-exact",
      "kind": "attribute",
      "assurance": "now",
      "expect": {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"},
      "request": {
        "id": "attribute-list-stays-exact",
        "tenant": "tenant:platform",
        "subject": {
          "id": "synthetic-reviewer",
          "type": "human",
          "tenant": "tenant:platform",
          "attributes": {
            "principal_type_source": "authentication-derived",
            "tenant_source": "registration-supplied",
            "groups": ["net-kingdom-admins"],
            "assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "methods": ["pwd", "otp"], "at": 0}
          }
        },
        "action": "list",
        "resource": {"id": "memo:intake-new-memo", "type": "decision-memo", "system": "informed-decision", "tenant": "tenant:platform"},
        "context": {
          "review_group": "net-kingdom-admins",
          "memo_class": "credential-lane",
          "intake_submitter": "state-hub",
          "approval_requester": "informed-decision",
          "approval_human_control": true,
          "memo_version": 1,
          "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
          "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
        },
        "policy_version": "v8"
      }
    }
  ]
}