tegwick
56940727bf
Close the remaining PDP obligations: mechanical layer declaration check, registry-snapshot digest in provenance, explicit allow TTL, per-input-class freshness deadlines, and the published decision-record contract. Document the canonical request digest as the §6.4.2 replay test. Assistant: grok Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0
100 lines
2.8 KiB
JSON
100 lines
2.8 KiB
JSON
{
|
|
"id": "decision:tenant-alpha-internal-note",
|
|
"contract_version": "flex-auth.decision-record.v1",
|
|
"request_id": "check:tenant-alpha-internal-note",
|
|
"effect": "allow",
|
|
"reason": "reader_relation",
|
|
"matched_policy_version": "markitect.documents.v1",
|
|
"matched_rule": "allow_document_read",
|
|
"resource": {
|
|
"id": "document:internal-note",
|
|
"type": "document",
|
|
"system": "markitect-tool",
|
|
"tenant": "tenant:alpha"
|
|
},
|
|
"subject": {
|
|
"id": "user:alice",
|
|
"type": "Human",
|
|
"tenant": "tenant:alpha"
|
|
},
|
|
"binding": {
|
|
"tenant": "tenant:alpha",
|
|
"subject": {
|
|
"id": "user:alice",
|
|
"type": "Human",
|
|
"tenant": "tenant:alpha"
|
|
},
|
|
"action": "read",
|
|
"resource": {
|
|
"id": "document:internal-note",
|
|
"type": "document",
|
|
"system": "markitect-tool",
|
|
"tenant": "tenant:alpha"
|
|
},
|
|
"context": {
|
|
"purpose": "project-delivery"
|
|
},
|
|
"request_digest": "sha256:99f772642c55b232a2d2fd3d5ff223cf1bf2c4f68942cd0def7c02cd3e5ae6ae"
|
|
},
|
|
"lifetime": {
|
|
"kind": "ttl",
|
|
"ttl": "15m",
|
|
"not_before": "2026-05-17T00:00:00Z",
|
|
"expires_at": "2026-05-17T00:15:00Z"
|
|
},
|
|
"obligations": [
|
|
{
|
|
"type": "log_access",
|
|
"parameters": {
|
|
"level": "standard"
|
|
}
|
|
}
|
|
],
|
|
"diagnostics": {
|
|
"policy_package": "examples/caring"
|
|
},
|
|
"provenance": {
|
|
"evaluator": "flex-auth",
|
|
"mode": "standalone",
|
|
"policy_package": "markitect.documents",
|
|
"policy_version": "v1",
|
|
"policy_package_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
|
"registry_snapshot_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
|
|
"input_claim_digests": {
|
|
"context": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
|
|
},
|
|
"decision_time": "2026-05-17T00:00:00Z"
|
|
},
|
|
"caring": {
|
|
"profile": "caring-0.4.0-rc2",
|
|
"descriptor": {
|
|
"id": "descriptor:tenant-alpha-document-reader",
|
|
"profile": "caring-0.4.0-rc2",
|
|
"subject_type": "Human",
|
|
"organization_relation": "Customer",
|
|
"canonical_role": "Doer",
|
|
"scope": {
|
|
"level": "Resource",
|
|
"id": "document:internal-note",
|
|
"tenant": "tenant:alpha",
|
|
"resource": "document:internal-note"
|
|
},
|
|
"planes": ["Data"],
|
|
"capabilities": ["View"],
|
|
"exposure_modes": ["Masked", "Plaintext"],
|
|
"conditions": ["PurposeBound", "Logged"],
|
|
"lifecycle_state": "Operate",
|
|
"restrictions": ["ExportBlocked"],
|
|
"access_path": "direct"
|
|
},
|
|
"restrictions_evaluated": ["ExportBlocked"],
|
|
"exposure_modes": ["Masked", "Plaintext"],
|
|
"conformance_findings": [
|
|
{
|
|
"code": "CARING-EXPORT-SEPARATION",
|
|
"severity": "info",
|
|
"message": "View is allowed, but Exportable exposure remains separately blocked."
|
|
}
|
|
]
|
|
}
|
|
}
|