feat(authz): bind decisions to exact actions

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

examples/caring/action_authorization.json

@@ -0,0 +1,103 @@
+{
+  "schema_version": "0.1",
+  "id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
+  "status": "approved",
+  "request": {
+    "id": "check:secrets-engine-destroy-example",
+    "subject": {
+      "id": "user:alice",
+      "type": "Human"
+    },
+    "action": "destroy",
+    "resource": {
+      "id": "catalog:example-build-test-token",
+      "type": "secret-catalog-lane",
+      "system": "secrets-engine",
+      "attributes": {
+        "stage": "build",
+        "fields": ["token"],
+        "policy_targets": [],
+        "auth_targets": []
+      }
+    },
+    "context": {
+      "purpose": "contract-test"
+    }
+  },
+  "validity": {
+    "not_before": "2026-08-23T10:00:00Z",
+    "expires_at": "2026-08-23T10:15:00Z"
+  },
+  "approvals": {
+    "required_count": 2,
+    "entries": [
+      {
+        "subject_id": "user:alice",
+        "approved_at": "2026-08-23T10:01:00Z",
+        "assurance": "mfa",
+        "evidence_ref": "approval:alice"
+      },
+      {
+        "subject_id": "user:bob",
+        "approved_at": "2026-08-23T10:02:00Z",
+        "assurance": "mfa",
+        "evidence_ref": "approval:bob"
+      }
+    ]
+  },
+  "decision": {
+    "id": "decision:contract-example",
+    "request_id": "check:secrets-engine-destroy-example",
+    "effect": "allow",
+    "reason": "destruction_approved",
+    "matched_policy_version": "v1",
+    "matched_rule": "allow_destroy",
+    "resource": {
+      "id": "catalog:example-build-test-token",
+      "type": "secret-catalog-lane",
+      "system": "secrets-engine",
+      "attributes": {
+        "stage": "build",
+        "fields": ["token"],
+        "policy_targets": [],
+        "auth_targets": []
+      }
+    },
+    "subject": {
+      "id": "user:alice",
+      "type": "Human"
+    },
+    "binding": {
+      "subject": {
+        "id": "user:alice",
+        "type": "Human"
+      },
+      "action": "destroy",
+      "resource": {
+        "id": "catalog:example-build-test-token",
+        "type": "secret-catalog-lane",
+        "system": "secrets-engine",
+        "attributes": {
+          "stage": "build",
+          "fields": ["token"],
+          "policy_targets": [],
+          "auth_targets": []
+        }
+      },
+      "context": {
+        "purpose": "contract-test"
+      },
+      "request_digest": "sha256:15a07a9ca41df90f0a97568ecb3547bb9a75b8b04bb96a7197e86fe4589c1f45"
+    },
+    "provenance": {
+      "evaluator": "flex-auth/local",
+      "mode": "standalone",
+      "policy_package": "secrets-engine.lifecycle",
+      "policy_version": "v1",
+      "decision_time": "2026-08-23T10:00:30Z"
+    }
+  },
+  "provenance": {
+    "authority": "state-hub"
+  }
+}

examples/caring/decision_envelope.json

@@ -16,6 +16,25 @@
     "type": "Human",
     "tenant": "tenant:alpha"
   },
+  "binding": {
+    "tenant": "tenant:alpha",
+    "subject": {
+      "id": "user:alice",
+      "type": "Human",
+      "tenant": "tenant:alpha"
+    },
+    "action": "read",
+    "resource": {
+      "id": "document:internal-note",
+      "type": "document",
+      "system": "markitect-tool",
+      "tenant": "tenant:alpha"
+    },
+    "context": {
+      "purpose": "project-delivery"
+    },
+    "request_digest": "sha256:76ddf09170fc5ac49fb58aa9a6f5fb25bf1eb68b969254553979eb1ee0f15fab"
+  },
   "obligations": [
     {
       "type": "log_access",