[
  {
    "id": "attribute-non-human-refused",
    "request": {
      "id": "attribute-non-human",
      "tenant": "tenant:platform",
      "subject": {
        "id": "not-a-person",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "principal_type_source": "authentication-derived",
          "tenant_source": "registration-supplied",
          "groups": ["net-kingdom-admins"],
          "assurance": {
            "level": "aal2",
            "mfa": true,
            "source": "key-cape",
            "methods": ["pwd", "otp"],
            "at": 1
          }
        }
      },
      "action": "accept",
      "resource": {
        "id": "memo:intake-new-memo",
        "type": "decision-memo",
        "system": "informed-decision",
        "tenant": "tenant:platform"
      },
      "context": {
        "review_group": "net-kingdom-admins",
        "memo_class": "credential-lane",
        "intake_submitter": "state-hub",
        "approval_requester": "informed-decision",
        "approval_human_control": true,
        "memo_version": 1,
        "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
        "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
      },
      "policy_version": "v8"
    },
    "expect": {
      "effect": "deny",
      "reason": "identity_refused"
    }
  },
  {
    "id": "attribute-stale-mfa",
    "request": {
      "id": "attribute-stale-mfa",
      "tenant": "tenant:platform",
      "subject": {
        "id": "test-human",
        "type": "human",
        "tenant": "tenant:platform",
        "attributes": {
          "principal_type_source": "authentication-derived",
          "tenant_source": "registration-supplied",
          "groups": ["net-kingdom-admins"],
          "assurance": {
            "level": "aal2",
            "mfa": true,
            "source": "key-cape",
            "methods": ["pwd", "otp"],
            "at": 1
          }
        }
      },
      "action": "accept",
      "resource": {
        "id": "memo:intake-new-memo",
        "type": "decision-memo",
        "system": "informed-decision",
        "tenant": "tenant:platform"
      },
      "context": {
        "review_group": "net-kingdom-admins",
        "memo_class": "credential-lane",
        "intake_submitter": "state-hub",
        "approval_requester": "informed-decision",
        "approval_human_control": true,
        "memo_version": 1,
        "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
        "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
      },
      "policy_version": "v8"
    },
    "expect": {
      "effect": "deny",
      "reason": "stale_mfa"
    }
  },
  {
    "id": "attribute-future-mfa",
    "request": {
      "id": "attribute-future-mfa",
      "tenant": "tenant:platform",
      "subject": {
        "id": "test-human",
        "type": "human",
        "tenant": "tenant:platform",
        "attributes": {
          "principal_type_source": "authentication-derived",
          "tenant_source": "registration-supplied",
          "groups": ["net-kingdom-admins"],
          "assurance": {
            "level": "aal2",
            "mfa": true,
            "source": "key-cape",
            "methods": ["pwd", "otp"],
            "at": 9999999999
          }
        }
      },
      "action": "read",
      "resource": {
        "id": "memo:intake-new-memo",
        "type": "decision-memo",
        "system": "informed-decision",
        "tenant": "tenant:platform"
      },
      "context": {
        "review_group": "net-kingdom-admins",
        "memo_class": "credential-lane",
        "intake_submitter": "state-hub",
        "approval_requester": "informed-decision",
        "approval_human_control": true,
        "memo_version": 1,
        "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
        "approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
      },
      "policy_version": "v8"
    },
    "expect": {
      "effect": "deny",
      "reason": "identity_refused"
    }
  }
]