- id: unsigned-service-caller-not-authority
  request:
    tenant: tenant:platform
    subject: {id: secrets-engine, type: service}
    action: execute-ccr
    resource: {id: catalog:test, type: secret-catalog-lane, system: secrets-engine}
    context: {human_control: true, runtime_admission: true, verified: true}
  expect: {effect: deny, reason: service_execution_integration_unadmitted}