{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://flex-auth.netkingdom/schemas/decision_envelope.schema.json",
  "title": "DecisionEnvelope",
  "description": "Published flex-auth decision-record contract (flex-auth.decision-record.v1). This is the PDP's output artifact under security-layer-model_v0.7 \u00a717.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "id",
    "effect",
    "resource",
    "subject",
    "provenance"
  ],
  "properties": {
    "id": {
      "type": "string",
      "minLength": 1
    },
    "contract_version": {
      "const": "flex-auth.decision-record.v1"
    },
    "request_id": {
      "type": "string",
      "minLength": 1
    },
    "effect": {
      "enum": [
        "allow",
        "deny",
        "redact",
        "audit_only",
        "not_applicable"
      ]
    },
    "reason": {
      "type": "string"
    },
    "matched_policy_version": {
      "type": "string",
      "minLength": 1
    },
    "matched_rule": {
      "type": "string",
      "minLength": 1
    },
    "resource": {
      "$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/resource_ref"
    },
    "subject": {
      "$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/subject_ref"
    },
    "binding": {
      "$ref": "#/$defs/decision_binding"
    },
    "lifetime": {
      "$ref": "#/$defs/lifetime"
    },
    "obligations": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/obligation"
      }
    },
    "diagnostics": {
      "type": "object",
      "additionalProperties": true
    },
    "provenance": {
      "$ref": "#/$defs/provenance"
    },
    "caring": {
      "$ref": "#/$defs/caring_decision_metadata"
    }
  },
  "allOf": [
    {
      "if": {
        "properties": {
          "effect": {
            "const": "allow"
          }
        },
        "required": [
          "effect"
        ]
      },
      "then": {
        "required": [
          "lifetime"
        ]
      }
    }
  ],
  "$defs": {
    "decision_binding": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "subject",
        "action",
        "resource",
        "request_digest"
      ],
      "properties": {
        "tenant": {
          "type": "string",
          "minLength": 1
        },
        "subject": {
          "$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/subject_ref"
        },
        "action": {
          "type": "string",
          "minLength": 1
        },
        "resource": {
          "$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json#/$defs/resource_ref"
        },
        "context": {
          "type": "object",
          "additionalProperties": true
        },
        "request_digest": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$"
        },
        "approval_binding_digest": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$",
          "description": "Present only when the request carried an approval claim on context.approval. The request digest computed with that claim removed from context, so it is stable across attaching the claim and can therefore be named by an approval's pdp_digest recorded at issue time (GH-DEC-2026-008, FLEX-DEC-2026-007). Compare claim.binding.pdp_digest to THIS value, never to request_digest: a claim can never equal the digest of the request that carries it. Not a replay identity -- two requests differing only in which approval was presented share this value and their decisions do not. request_digest remains the replay identity."
        }
      }
    },
    "obligation": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string",
          "minLength": 1
        },
        "parameters": {
          "type": "object",
          "additionalProperties": true
        }
      }
    },
    "lifetime": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "kind",
        "expires_at"
      ],
      "properties": {
        "kind": {
          "enum": [
            "ttl"
          ]
        },
        "ttl": {
          "type": "string",
          "minLength": 1
        },
        "not_before": {
          "type": "string",
          "minLength": 1
        },
        "expires_at": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "provenance": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "evaluator",
        "mode"
      ],
      "properties": {
        "evaluator": {
          "type": "string",
          "minLength": 1
        },
        "mode": {
          "type": "string",
          "minLength": 1
        },
        "policy_package": {
          "type": "string",
          "minLength": 1
        },
        "policy_version": {
          "type": "string",
          "minLength": 1
        },
        "policy_package_digest": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$"
        },
        "registry_snapshot_digest": {
          "type": "string",
          "pattern": "^sha256:[0-9a-f]{64}$"
        },
        "directory_etag": {
          "type": "string",
          "minLength": 1
        },
        "input_claim_digests": {
          "type": "object",
          "additionalProperties": {
            "type": "string",
            "pattern": "^sha256:[0-9a-f]{64}$"
          }
        },
        "decision_time": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "caring_decision_metadata": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "profile"
      ],
      "properties": {
        "profile": {
          "const": "caring-0.4.0-rc2"
        },
        "descriptor": {
          "$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json"
        },
        "restrictions_evaluated": {
          "type": "array",
          "items": {
            "$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/restriction"
          },
          "uniqueItems": true
        },
        "exposure_modes": {
          "type": "array",
          "items": {
            "$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/exposure_mode"
          },
          "uniqueItems": true
        },
        "derived_capabilities": {
          "type": "array",
          "items": {
            "$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/derived_capability"
          }
        },
        "conformance_findings": {
          "type": "array",
          "items": {
            "$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/conformance_finding"
          }
        },
        "exposure_event": {
          "$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/exposure_event"
        }
      }
    }
  }
}