[
  {
    "id": "fixture:tenant-engine-create-allow",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-role-grant-allow",
    "request": {
      "id": "check:tenant-engine-role-grant-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.role.grant",
      "resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-role-revoke-allow",
    "request": {
      "id": "check:tenant-engine-role-revoke-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.role.revoke",
      "resource": {"id": "t-1", "type": "role-grant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-plan-assign-allow",
    "request": {
      "id": "check:tenant-engine-plan-assign-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.plan.assign",
      "resource": {"id": "t-1", "type": "plan-assignment", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-update-allow",
    "request": {
      "id": "check:tenant-engine-update-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.update",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-retire-allow",
    "request": {
      "id": "check:tenant-engine-retire-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.retire",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-reactivate-allow",
    "request": {
      "id": "check:tenant-engine-reactivate-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.reactivate",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-update-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-update-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.update",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-retire-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-retire-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.retire",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-reactivate-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-reactivate-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.reactivate",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-misspelled-lifecycle-action-deny",
    "request": {
      "id": "check:tenant-engine-retired-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.retired",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-lifecycle-underscore-action-deny",
    "request": {
      "id": "check:tenant-engine-underscore-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant_update",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "some-other-service", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-wrong-system-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "some-other-system"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "wrong_system"}
  },
  {
    "id": "fixture:tenant-engine-unknown-action-deny",
    "request": {
      "id": "check:tenant-engine-delete-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.delete",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  },
  {
    "id": "fixture:tenant-engine-wrong-subject-type-deny",
    "request": {
      "id": "check:tenant-engine-create-t1",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "human"},
      "action": "tenant.create",
      "resource": {"id": "t-1", "type": "tenant", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "wrong_subject_type"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-read-pdp-allow",
    "request": {
      "id": "check:tenant-engine-guardrail-read-pdp",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "flex-auth", "type": "service"},
      "action": "tenant.guardrail.read",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-read-writer-allow",
    "request": {
      "id": "check:tenant-engine-guardrail-read-writer",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.guardrail.read",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-set-writer-allow",
    "request": {
      "id": "check:tenant-engine-guardrail-set-writer",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "tenant-engine", "type": "service"},
      "action": "tenant.guardrail.set",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "allow", "reason": "write_api_policy_matched"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-set-pdp-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-set-pdp",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "flex-auth", "type": "service"},
      "action": "tenant.guardrail.set",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "action_not_granted"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-read-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-read-ops",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "ops", "type": "service"},
      "action": "tenant.guardrail.read",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-guardrail-set-unknown-subject-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-set-ops",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "ops", "type": "service"},
      "action": "tenant.guardrail.set",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_subject"}
  },
  {
    "id": "fixture:tenant-engine-misspelled-guardrail-action-deny",
    "request": {
      "id": "check:tenant-engine-guardrail-get",
      "tenant": "tenant:friendly:binky",
      "subject": {"id": "flex-auth", "type": "service"},
      "action": "tenant.guardrail.get",
      "resource": {"id": "t-1", "type": "guardrail", "system": "tenant-engine"},
      "context": {}
    },
    "expect": {"effect": "deny", "reason": "unknown_action"}
  }
]