[
  {
    "id": "fixture:secrets-engine-apply-allow",
    "request": {
      "id": "check:secrets-engine-apply",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "apply",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-provision-allow",
    "request": {
      "id": "check:secrets-engine-provision",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "provision",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-rotate-allow",
    "request": {
      "id": "check:secrets-engine-rotate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "rotate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-verify-allow",
    "request": {
      "id": "check:secrets-engine-verify",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "verify",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-handoff-allow",
    "request": {
      "id": "check:secrets-engine-handoff",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "handoff",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-wrap-allow",
    "request": {
      "id": "check:secrets-engine-wrap",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "wrap",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-exec-allow",
    "request": {
      "id": "check:secrets-engine-exec",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "exec",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-deactivate-allow",
    "request": {
      "id": "check:secrets-engine-deactivate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "deactivate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-suspend-allow",
    "request": {
      "id": "check:secrets-engine-suspend",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "suspend",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-compromise-allow",
    "request": {
      "id": "check:secrets-engine-compromise",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "compromise",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-reactivate-allow",
    "request": {
      "id": "check:secrets-engine-reactivate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "reactivate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-dual-control-allow",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "approval-claim",
          "issuer": "approval-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "valid",
          "valid_now": true,
          "consumed": false,
          "reason_code": "ok"
        }
      }
    },
    "expect": {
      "effect": "allow",
      "reason": "catalog_lane_policy_matched"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-no-claim-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-insufficient-approvers-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "approval-claim",
          "issuer": "approval-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "requested",
          "valid_now": false,
          "consumed": false,
          "reason_code": "insufficient_approvers"
        }
      }
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-consumed-claim-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "approval-claim",
          "issuer": "approval-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "consumed",
          "valid_now": false,
          "consumed": true,
          "reason_code": "consumed"
        }
      }
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-revoked-claim-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "approval-claim",
          "issuer": "approval-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "revoked",
          "valid_now": false,
          "consumed": false,
          "reason_code": "revoked"
        }
      }
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-approved-not-valid-now-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "approval-claim",
          "issuer": "approval-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "approved",
          "valid_now": false,
          "consumed": false,
          "reason_code": "not_yet_valid"
        }
      }
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-foreign-issuer-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "approval-claim",
          "issuer": "some-other-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "valid",
          "valid_now": true,
          "consumed": false,
          "reason_code": "ok"
        }
      }
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-destroy-wrong-kind-deny",
    "request": {
      "id": "check:secrets-engine-destroy",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "destroy",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {
        "approval": {
          "schema_version": "0.1",
          "kind": "action-authorization",
          "issuer": "approval-engine",
          "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
          "state": "valid",
          "valid_now": true,
          "consumed": false,
          "reason_code": "ok"
        }
      }
    },
    "expect": {
      "effect": "deny",
      "reason": "dual_control_required"
    }
  },
  {
    "id": "fixture:secrets-engine-revoke-not-an-action-deny",
    "request": {
      "id": "check:secrets-engine-revoke",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "revoke",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_action"
    }
  },
  {
    "id": "fixture:secrets-engine-ungated-plan-deny",
    "request": {
      "id": "check:secrets-engine-plan",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "plan",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_action"
    }
  },
  {
    "id": "fixture:secrets-engine-ungated-route-deny",
    "request": {
      "id": "check:secrets-engine-route",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "route",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_action"
    }
  },
  {
    "id": "fixture:secrets-engine-ungated-audit-deny",
    "request": {
      "id": "check:secrets-engine-audit",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "audit",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_action"
    }
  },
  {
    "id": "fixture:secrets-engine-ungated-catalog-deny",
    "request": {
      "id": "check:secrets-engine-catalog",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "catalog",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_action"
    }
  },
  {
    "id": "fixture:secrets-engine-ungated-evidence-deny",
    "request": {
      "id": "check:secrets-engine-evidence",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "evidence",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_action"
    }
  },
  {
    "id": "fixture:secrets-engine-unknown-subject-deny",
    "request": {
      "id": "check:secrets-engine-rotate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "some-other-service",
        "type": "service"
      },
      "action": "rotate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "unknown_subject"
    }
  },
  {
    "id": "fixture:secrets-engine-wrong-subject-type-deny",
    "request": {
      "id": "check:secrets-engine-rotate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "human"
      },
      "action": "rotate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "wrong_subject_type"
    }
  },
  {
    "id": "fixture:secrets-engine-wrong-system-deny",
    "request": {
      "id": "check:secrets-engine-rotate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "rotate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret-catalog-lane",
        "system": "some-other-system",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "wrong_system"
    }
  },
  {
    "id": "fixture:secrets-engine-wrong-resource-type-deny",
    "request": {
      "id": "check:secrets-engine-rotate",
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "rotate",
      "resource": {
        "id": "lane:glas-primary",
        "type": "secret",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "password"
          ],
          "policy_targets": [],
          "auth_targets": []
        }
      },
      "context": {}
    },
    "expect": {
      "effect": "deny",
      "reason": "wrong_resource_type"
    }
  }
]