- id: unsigned-provider-refused
  request:
    tenant: tenant:platform
    subject: {id: secrets-engine, type: service}
    action: execute-ccr
    resource: {id: catalog:test, type: secret-catalog-lane, system: secrets-engine}
    context: {human_control: true, verified: true, owner_admission: true}
  expect: {effect: deny, reason: initiating_provider_unadmitted}
- id: legacy-action-cannot-borrow-task-policy
  request:
    tenant: tenant:platform
    subject: {id: secrets-engine, type: service}
    action: apply
    resource: {id: catalog:test, type: secret-catalog-lane, system: secrets-engine}
    context: {human_control: true}
  expect: {effect: deny, reason: initiating_provider_unadmitted}