- id: fixture:credential-grant-allow
  request: &allow_request
    id: check:credential-grant-allow
    tenant: tenant:platform
    subject: {id: agent:codex/railiance-platform, type: Agent}
    action: issue
    resource:
      id: credential-grant:rapp-postgres/audit-core-runtime
      type: credential-grant
      system: railiance-platform
      attributes:
        grant_id: rapp-postgres/audit-core-runtime
        credential_type: openbao-database-credential
        issuer: openbao
        audience: audit-core
        max_ttl_seconds: 3600
        allowed_actor_types: [human-operator, approved-agent, ci-runner]
        allowed_purposes: [audit-core-runtime]
        allowed_delivery_modes: [exec-env]
    context: &allow_context
      actor_type: approved-agent
      bound_subject: agent:codex/railiance-platform
      purpose: audit-core-runtime
      delivery_mode: exec-env
      requested_ttl_seconds: 900
  expect: {effect: allow, reason: credential_grant_allowed}
- id: fixture:credential-grant-ttl-deny
  request:
    <<: *allow_request
    id: check:credential-grant-ttl-deny
    context: {<<: *allow_context, requested_ttl_seconds: 5400}
  expect: {effect: deny, reason: ttl_out_of_bounds}
- id: fixture:credential-grant-actor-type-deny
  request:
    <<: *allow_request
    id: check:credential-grant-actor-deny
    context: {<<: *allow_context, actor_type: unapproved-agent}
  expect: {effect: deny, reason: actor_type_not_allowed}
- id: fixture:credential-grant-purpose-deny
  request:
    <<: *allow_request
    id: check:credential-grant-purpose-deny
    context: {<<: *allow_context, purpose: unrelated-purpose}
  expect: {effect: deny, reason: purpose_not_allowed}
- id: fixture:credential-grant-delivery-deny
  request:
    <<: *allow_request
    id: check:credential-grant-delivery-deny
    context: {<<: *allow_context, delivery_mode: chat}
  expect: {effect: deny, reason: delivery_mode_not_allowed}
- id: fixture:credential-grant-unknown-deny
  request:
    <<: *allow_request
    id: check:credential-grant-unknown-deny
    resource:
      id: credential-grant:unknown/grant
      type: credential-grant
      system: railiance-platform
  expect: {effect: deny, reason: unknown_grant}