{
  "systems": [
    {
      "id": "qonto-assistant",
      "name": "Qonto Governed Assistant",
      "resource_types": [
        {
          "name": "finance-snapshot",
          "scope_level": "Resource",
          "planes": [
            "Data",
            "Audit"
          ],
          "metadata": {
            "description": "Read-only Qonto finance capability surface (org summary, transactions, CostRunRate hints). No spend/transfer/card/write capability is ever registered here -- those are hard-denied inside qonto-assistant's own policy kernel and never reach flex-auth."
          }
        }
      ],
      "actions": [
        {
          "name": "finance.qonto.read",
          "capabilities": [
            "View",
            "Audit"
          ],
          "planes": [
            "Data",
            "Audit"
          ],
          "exposure_modes": [
            "Masked"
          ],
          "metadata": {
            "required_context": [],
            "description": "Coarse \"may this actor use qonto-assistant's read surface at all\" gate. Tenant capability-role/plan liveness (VEN/CUS, ADR-0014) is a separate check against tenant-engine's live-lookup endpoint, not encoded in this policy."
          }
        }
      ],
      "caring_profiles": [
        "caring-0.4.0-rc2"
      ],
      "metadata": {
        "flex_auth_contract": "protected-system-v0",
        "boundary_contract": "qonto-assistant/docs/SecurityPractice.md"
      }
    }
  ],
  "resource_manifests": [],
  "tenants": [
    {
      "id": "tenant:friendly:binky",
      "name": "Binky Hedgehog GmbH"
    }
  ],
  "subjects": [
    {
      "id": "agent-harness-binky",
      "type": "Agent",
      "display_name": "agent-harness session (binky tenant)",
      "organization_relation": "ServiceProvider",
      "roles": [
        "Operator"
      ],
      "groups": [
        "group:qonto-assistant-readers"
      ],
      "tenant": "tenant:friendly:binky",
      "metadata": {
        "description": "Harness-run agent sessions calling qonto-assistant's finance.qonto.read capability over REST or MCP."
      }
    },
    {
      "id": "bernd.worsch",
      "type": "Human",
      "display_name": "Bernd Worsch (founder)",
      "organization_relation": "Customer",
      "roles": [
        "Operator"
      ],
      "groups": [
        "group:qonto-assistant-readers"
      ],
      "tenant": "tenant:friendly:binky",
      "metadata": {
        "description": "Founder operator, human REST/MCP caller."
      }
    }
  ],
  "groups": [
    {
      "id": "group:qonto-assistant-readers",
      "display_name": "qonto-assistant finance.qonto.read callers",
      "members": [
        "agent-harness-binky",
        "bernd.worsch"
      ],
      "tenant": "tenant:friendly:binky"
    }
  ],
  "relationships": []
}