{
  "id": "decision:44a40c339a020772",
  "contract_version": "flex-auth.decision-record.v1",
  "request_id": "check:secrets-engine-destroy",
  "effect": "allow",
  "reason": "catalog_lane_policy_matched",
  "matched_policy_version": "v1",
  "matched_rule": "catalog_lane_policy_matched",
  "resource": {
    "id": "lane:glas-primary",
    "type": "secret-catalog-lane",
    "system": "secrets-engine",
    "tenant": "tenant:platform",
    "attributes": {
      "auth_targets": [],
      "fields": [],
      "policy_targets": [],
      "stage": "prod"
    }
  },
  "subject": {
    "id": "secrets-engine",
    "type": "service",
    "tenant": "tenant:platform",
    "attributes": {
      "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
      "display_name": "secrets-engine service principal",
      "groups": [
        "group:secrets-engine-lane-operators"
      ],
      "organization_relation": "ServiceProvider",
      "roles": [
        "Operator"
      ]
    }
  },
  "binding": {
    "tenant": "tenant:platform",
    "subject": {
      "id": "secrets-engine",
      "type": "service",
      "tenant": "tenant:platform",
      "attributes": {
        "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
        "display_name": "secrets-engine service principal",
        "groups": [
          "group:secrets-engine-lane-operators"
        ],
        "organization_relation": "ServiceProvider",
        "roles": [
          "Operator"
        ]
      }
    },
    "action": "destroy",
    "resource": {
      "id": "lane:glas-primary",
      "type": "secret-catalog-lane",
      "system": "secrets-engine",
      "tenant": "tenant:platform",
      "attributes": {
        "auth_targets": [],
        "fields": [],
        "policy_targets": [],
        "stage": "prod"
      }
    },
    "context": {
      "approval": {
        "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
        "binding": {
          "action": "secrets.kv.destroy",
          "actor": "agt-secrets-engine",
          "digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
          "pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
          "pdp_path": true,
          "principal": "bernd",
          "purpose": "rotate-exposed-key",
          "target": {
            "id": "lane-openbao-root",
            "stage": "prod"
          }
        },
        "consumed": false,
        "freshness": {
          "not_after": "2026-09-06T12:00:30+00:00",
          "observed_at": "2026-09-06T12:00:00+00:00",
          "ttl_seconds": 30
        },
        "issuer": "approval-engine",
        "kind": "approval-claim",
        "reason_code": "ok",
        "schema_version": "0.1",
        "state": "valid",
        "valid_now": true,
        "validity": {
          "expires_at": "2026-09-06T15:00:00+00:00",
          "not_before": "2026-09-06T11:00:00+00:00"
        }
      }
    },
    "request_digest": "sha256:c749ee2dc3cdf927a70a3e5b27cff4d97a438d3264153b4b2e3bcacbaf82091a",
    "approval_binding_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56"
  },
  "lifetime": {
    "kind": "ttl",
    "ttl": "15m",
    "not_before": "2026-09-06T12:51:16Z",
    "expires_at": "2026-09-06T13:06:16Z"
  },
  "diagnostics": {
    "action": "destroy",
    "matched_relationship": "",
    "policy_package": "secrets-engine.catalog-lane.lifecycle",
    "policy_status": "ready",
    "registry_resource": false,
    "registry_subject": true
  },
  "provenance": {
    "evaluator": "flex-auth/local",
    "mode": "standalone",
    "policy_package": "secrets-engine.catalog-lane.lifecycle",
    "policy_version": "v1",
    "policy_package_digest": "sha256:fe0070b79f66442ae6c218697a49c470c6c8f670aa57a30c078a5284d097bd8c",
    "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
    "input_claim_digests": {
      "context": "sha256:8b73d29ecef286d42e03d2420531d6c45219f325a7ae004c1ecfc781203a2800"
    },
    "decision_time": "2026-09-06T12:51:16Z"
  },
  "caring": {
    "profile": "caring-0.4.0-rc2",
    "conformance_findings": [
      {
        "code": "CARING-DESCRIPTOR-MISSING",
        "severity": "warning",
        "message": "no CARING descriptor matched the request",
        "fields": [
          "caring_context"
        ]
      }
    ]
  }
}