flex-auth/docs/evidence/2026-09-14-t03-review-policy.json

{
  "scope": "local actual evaluator with synthetic identity; no live human approvals",
  "checks": [
    {
      "check": "apply:read",
      "effect": "allow"
    },
    {
      "check": "apply:acknowledge",
      "effect": "allow"
    },
    {
      "check": "apply:accept",
      "effect": "allow"
    },
    {
      "check": "apply:return",
      "effect": "allow"
    },
    {
      "check": "apply:discuss",
      "effect": "allow"
    },
    {
      "check": "apply:decline",
      "effect": "allow"
    },
    {
      "check": "apply:wrong-group",
      "effect": "deny"
    },
    {
      "check": "apply:no-group",
      "effect": "deny"
    },
    {
      "check": "apply:service",
      "effect": "deny"
    },
    {
      "check": "apply:stale-mfa",
      "effect": "deny"
    },
    {
      "check": "apply:future-mfa",
      "effect": "deny"
    },
    {
      "check": "apply:no-mfa",
      "effect": "deny"
    },
    {
      "check": "apply:forged-human-route",
      "effect": "deny"
    },
    {
      "check": "apply:wrong-tenant",
      "effect": "deny"
    },
    {
      "check": "apply:other-memo",
      "effect": "deny"
    },
    {
      "check": "apply:changed-version",
      "effect": "deny"
    },
    {
      "check": "apply:changed-approval",
      "effect": "deny"
    },
    {
      "check": "apply:changed-digest",
      "effect": "deny"
    },
    {
      "check": "apply:consume",
      "effect": "deny"
    },
    {
      "check": "verify:read",
      "effect": "allow"
    },
    {
      "check": "verify:acknowledge",
      "effect": "allow"
    },
    {
      "check": "verify:accept",
      "effect": "allow"
    },
    {
      "check": "verify:return",
      "effect": "allow"
    },
    {
      "check": "verify:discuss",
      "effect": "allow"
    },
    {
      "check": "verify:decline",
      "effect": "allow"
    },
    {
      "check": "verify:wrong-group",
      "effect": "deny"
    },
    {
      "check": "verify:no-group",
      "effect": "deny"
    },
    {
      "check": "verify:service",
      "effect": "deny"
    },
    {
      "check": "verify:stale-mfa",
      "effect": "deny"
    },
    {
      "check": "verify:future-mfa",
      "effect": "deny"
    },
    {
      "check": "verify:no-mfa",
      "effect": "deny"
    },
    {
      "check": "verify:forged-human-route",
      "effect": "deny"
    },
    {
      "check": "verify:wrong-tenant",
      "effect": "deny"
    },
    {
      "check": "verify:other-memo",
      "effect": "deny"
    },
    {
      "check": "verify:changed-version",
      "effect": "deny"
    },
    {
      "check": "verify:changed-approval",
      "effect": "deny"
    },
    {
      "check": "verify:changed-digest",
      "effect": "deny"
    },
    {
      "check": "verify:consume",
      "effect": "deny"
    },
    {
      "check": "exec:read",
      "effect": "allow"
    },
    {
      "check": "exec:acknowledge",
      "effect": "allow"
    },
    {
      "check": "exec:accept",
      "effect": "allow"
    },
    {
      "check": "exec:return",
      "effect": "allow"
    },
    {
      "check": "exec:discuss",
      "effect": "allow"
    },
    {
      "check": "exec:decline",
      "effect": "allow"
    },
    {
      "check": "exec:wrong-group",
      "effect": "deny"
    },
    {
      "check": "exec:no-group",
      "effect": "deny"
    },
    {
      "check": "exec:service",
      "effect": "deny"
    },
    {
      "check": "exec:stale-mfa",
      "effect": "deny"
    },
    {
      "check": "exec:future-mfa",
      "effect": "deny"
    },
    {
      "check": "exec:no-mfa",
      "effect": "deny"
    },
    {
      "check": "exec:forged-human-route",
      "effect": "deny"
    },
    {
      "check": "exec:wrong-tenant",
      "effect": "deny"
    },
    {
      "check": "exec:other-memo",
      "effect": "deny"
    },
    {
      "check": "exec:changed-version",
      "effect": "deny"
    },
    {
      "check": "exec:changed-approval",
      "effect": "deny"
    },
    {
      "check": "exec:changed-digest",
      "effect": "deny"
    },
    {
      "check": "exec:consume",
      "effect": "deny"
    }
  ]
}