From 7996a8e23b5fe641db284a5ec1dd26702c0f1f62 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sat, 3 Oct 2026 19:17:17 +0200
Subject: [PATCH] Record p01 approval creation and tested v7 admission
 candidate

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
---
 .../access-engine-v7.patch                    |   59 +
 ...ovisioning-window-admission-candidate.json |   11 +
 ...3-provisioning-window-approval-create.json |   41 +
 ...ioning-window-policy-candidate-checks.json | 3185 +++++++++++++++++
 workplans/ADHOC-2026-10-03.md                 |   26 +-
 5 files changed, 3321 insertions(+), 1 deletion(-)
 create mode 100644 docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch
 create mode 100644 docs/evidence/2026-10-03-provisioning-window-admission-candidate.json
 create mode 100644 docs/evidence/2026-10-03-provisioning-window-approval-create.json
 create mode 100644 docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json

diff --git a/docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch b/docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch
new file mode 100644
index 0000000..6ab93c3
--- /dev/null
+++ b/docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch
@@ -0,0 +1,59 @@
+--- a/examples/informed-decision-sitting/policy.md
++++ b/examples/informed-decision-sitting/policy.md
+@@ -2,7 +2,7 @@
+ id: informed-decision.compact-sitting
+ name: Compact sitting exact-record human review
+ namespace: informed-decision:decision-memo
+-version: v6
++version: v7
+ status: ready
+ package: flexauth.informed_decision.compact_sitting
+ allow_ttl: 30s
+@@ -59,6 +59,11 @@
+ still require the authenticated human and fresh MFA. Ordinary worker approvals
+ retain their native control type and require exact-ID consumer configuration.
+ 
++v7 (2026-10-03, INFD-WP-ADHOC-2026-10-03-T02) adds the exact
++`memo:infd-20261003-p01` delivery-proof acceptance record. Native pins come
++from informed-decision `docs/evidence/2026-10-03-provisioning-window-approval-create.json`.
++Existing records and identity requirements are preserved.
++
+ The identity bar matches T03: authenticated informed-decision caller,
+ `net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
+ memo content or presentation state. TokenReview must admit
+@@ -72,6 +77,10 @@
+ import rego.v1
+ 
+ records := {
++  "memo:infd-20261003-p01": {
++    "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
++    "binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
++  },
+   "memo:infd-20260914-c02": {
+     "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
+     "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
+--- a/examples/informed-decision-sitting/records.json
++++ b/examples/informed-decision-sitting/records.json
+@@ -338,5 +338,22 @@
+       }
+     },
+     "memo_version": 1
++  },
++  "memo:infd-20261003-p01": {
++    "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
++    "binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
++    "label": "p01",
++    "binding": {
++      "action": "accept",
++      "actor": "informed-decision",
++      "principal": "railiance-platform",
++      "purpose": "Accept the 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader",
++      "target": {
++        "id": "ccr:CCR-2026-0019-delivery-proof",
++        "type": "credential-lane",
++        "system": "railiance-platform"
++      }
++    },
++    "memo_version": 1
+   }
+ }
diff --git a/docs/evidence/2026-10-03-provisioning-window-admission-candidate.json b/docs/evidence/2026-10-03-provisioning-window-admission-candidate.json
new file mode 100644
index 0000000..fa44c92
--- /dev/null
+++ b/docs/evidence/2026-10-03-provisioning-window-admission-candidate.json
@@ -0,0 +1,11 @@
+{
+  "scope": "offline evaluator with synthetic identity; no live admission or human approval",
+  "memo_id": "infd-20261003-p01",
+  "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
+  "binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
+  "policy_version": "v7",
+  "policy_package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
+  "old_records": 16,
+  "new_records": 17,
+  "read_effect": "allow"
+}
diff --git a/docs/evidence/2026-10-03-provisioning-window-approval-create.json b/docs/evidence/2026-10-03-provisioning-window-approval-create.json
new file mode 100644
index 0000000..7f040de
--- /dev/null
+++ b/docs/evidence/2026-10-03-provisioning-window-approval-create.json
@@ -0,0 +1,41 @@
+{
+  "observed_at": "2026-10-03T17:08:08.076377+00:00",
+  "status": "created",
+  "phase": "seven_unapproved_requests_created",
+  "requests": [
+    {
+      "memo_id": "infd-20261003-p01",
+      "approval": {
+        "binding": {
+          "action": "accept",
+          "actor": "informed-decision",
+          "digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
+          "human_control": true,
+          "pdp_digest": null,
+          "pdp_path": false,
+          "principal": "railiance-platform",
+          "purpose": "Accept the 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader",
+          "target": {
+            "id": "ccr:CCR-2026-0019-delivery-proof",
+            "system": "railiance-platform",
+            "type": "credential-lane"
+          }
+        },
+        "created_at": "2026-10-03T17:08:12+00:00",
+        "entries": [],
+        "id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
+        "required_count": 1,
+        "status": "requested",
+        "superseded_by": null,
+        "updated_at": "2026-10-03T17:08:12+00:00",
+        "validity": {
+          "expires_at": "2026-10-04T17:08:09.951582+00:00",
+          "not_before": "2026-10-03T17:08:09.951582+00:00"
+        }
+      }
+    }
+  ],
+  "credential_values_emitted": false,
+  "human_entries_created": false,
+  "skipped": []
+}
diff --git a/docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json b/docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json
new file mode 100644
index 0000000..059df70
--- /dev/null
+++ b/docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json
@@ -0,0 +1,3185 @@
+{
+  "scope": "local actual evaluator with synthetic identity; no live human approvals; T03 package untouched",
+  "checks": [
+    {
+      "check": "c02:read",
+      "effect": "allow"
+    },
+    {
+      "check": "c02:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "c02:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "c02:return",
+      "effect": "allow"
+    },
+    {
+      "check": "c02:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "c02:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "c02:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:service",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "c02:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:read",
+      "effect": "allow"
+    },
+    {
+      "check": "c03:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "c03:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "c03:return",
+      "effect": "allow"
+    },
+    {
+      "check": "c03:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "c03:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "c03:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:service",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "c03:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:read",
+      "effect": "allow"
+    },
+    {
+      "check": "c04:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "c04:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "c04:return",
+      "effect": "allow"
+    },
+    {
+      "check": "c04:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "c04:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "c04:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:service",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "c04:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:read",
+      "effect": "allow"
+    },
+    {
+      "check": "d01:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "d01:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "d01:return",
+      "effect": "allow"
+    },
+    {
+      "check": "d01:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "d01:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "d01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "d01:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:read",
+      "effect": "allow"
+    },
+    {
+      "check": "d02:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "d02:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "d02:return",
+      "effect": "allow"
+    },
+    {
+      "check": "d02:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "d02:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "d02:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:service",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "d02:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:read",
+      "effect": "allow"
+    },
+    {
+      "check": "d03:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "d03:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "d03:return",
+      "effect": "allow"
+    },
+    {
+      "check": "d03:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "d03:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "d03:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:service",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "d03:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:read",
+      "effect": "allow"
+    },
+    {
+      "check": "d04:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "d04:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "d04:return",
+      "effect": "allow"
+    },
+    {
+      "check": "d04:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "d04:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "d04:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:service",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "d04:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:read",
+      "effect": "allow"
+    },
+    {
+      "check": "b01:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "b01:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "b01:return",
+      "effect": "allow"
+    },
+    {
+      "check": "b01:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "b01:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "b01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "b01:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:read",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b01:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b01:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b01:return",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b01:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b01:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b01:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:read",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b02:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b02:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b02:return",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b02:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b02:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "20260927-b02:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:service",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "20260927-b02:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:read",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-apply:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-apply:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-apply:return",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-apply:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-apply:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-apply:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:service",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-apply:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:read",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-verify:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-verify:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-verify:return",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-verify:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-verify:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-verify:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:service",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-verify:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:read",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-exec:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-exec:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-exec:return",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-exec:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-exec:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-provider-exec:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:service",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-provider-exec:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:read",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-apply:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-apply:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-apply:return",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-apply:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-apply:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-apply:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:service",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-apply:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:read",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-verify:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-verify:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-verify:return",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-verify:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-verify:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-verify:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:service",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-verify:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:read",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-exec:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-exec:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-exec:return",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-exec:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-exec:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "metered-20260927-worker-exec:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:service",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "metered-20260927-worker-exec:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:read",
+      "effect": "allow"
+    },
+    {
+      "check": "p01:acknowledge",
+      "effect": "allow"
+    },
+    {
+      "check": "p01:accept",
+      "effect": "allow"
+    },
+    {
+      "check": "p01:return",
+      "effect": "allow"
+    },
+    {
+      "check": "p01:discuss",
+      "effect": "allow"
+    },
+    {
+      "check": "p01:decline",
+      "effect": "allow"
+    },
+    {
+      "check": "p01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:stale-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:t03-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "p01:consume",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c02:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c02:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c02:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c02:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c03:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c03:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c03:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c03:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c04:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c04:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:c04:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:c04:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d01:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d01:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d01:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d02:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d02:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d02:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d02:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d03:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d03:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d03:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d03:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d04:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d04:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:d04:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:d04:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:b01:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:b01:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:b01:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:b01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:20260927-b01:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:20260927-b01:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:20260927-b01:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:20260927-b02:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:20260927-b02:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:20260927-b02:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:20260927-b02:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-apply:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-verify:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-provider-exec:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-apply:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-verify:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:metered-20260927-worker-exec:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:p01:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:p01:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:p01:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:p01:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-apply:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-apply:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-apply:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:act-read-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:act-acknowledge-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:act-accept-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:act-return-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:act-discuss-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:act-decline-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-apply:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-verify:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-verify:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-verify:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:act-read-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:act-acknowledge-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:act-accept-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:act-return-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:act-discuss-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:act-decline-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-verify:changed-digest",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:fresh",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-exec:observed-1744s",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-exec:inside-12h",
+      "effect": "allow"
+    },
+    {
+      "check": "list:t03-exec:past-12h",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:read-stale-refused",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:act-read-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:act-acknowledge-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:act-accept-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:act-return-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:act-discuss-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:act-decline-not-widened",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:wrong-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:no-group",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:service",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:agent",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:future-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:no-mfa",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:aal1",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:forged-human-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:indeterminate-route",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:wrong-tenant",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:other-memo",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:omitted-c01",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:other-system",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:changed-version",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:changed-approval",
+      "effect": "deny"
+    },
+    {
+      "check": "list:t03-exec:changed-digest",
+      "effect": "deny"
+    }
+  ]
+}
diff --git a/workplans/ADHOC-2026-10-03.md b/workplans/ADHOC-2026-10-03.md
index 5d234df..0dde9d3 100644
--- a/workplans/ADHOC-2026-10-03.md
+++ b/workplans/ADHOC-2026-10-03.md
@@ -40,10 +40,34 @@ id: INFD-WP-ADHOC-2026-10-03-T02
 status: wait
 needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "Founder runs OPERATOR.md Part A: attended approval create, Flex Auth v7 exact-record admission, load, human bind at decisions.coulomb.social."
+blocking_reason: "Attended approval creation complete; remaining: publish and deploy exact-record policy v7, load pinned memo, and founder human disposition at decisions.coulomb.social."
 priority: high
 state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
 ```
 
 Agents do not create the approval, admit the record, or bind. After the human
 disposition, record the receipt under `docs/evidence/` and update `sitting.json`.
+
+## Coaching progress — 2026-10-03
+
+A1 dry run passed. Founder completed A3 at 17:08 UTC. Receipt
+`docs/evidence/2026-10-03-provisioning-window-approval-create.json` records one
+requested human-control approval with no entries:
+`706f4205-aaa7-44f6-be30-d0f57664d69c`, carrying the native digest
+`sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4`.
+Binding fields match the reviewed intent. Validity ends 2026-10-04 17:08 UTC.
+
+A4 preparation: `docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch`
+adds only p01 to the policy and record manifest, advances v6 to v7, and preserves
+all 16 existing act records. It is a candidate for access-engine; no owner files
+or live policy were changed. Policy publication/deployment, load and human
+answer remain outstanding. This memo alone does not resolve hub decision D1.
+
+Offline candidate validation: 795 actual-evaluator checks passed, including
+p01 and all existing records. The harness's 12-hour-boundary timestamp was
+refreshed per list record in the temporary validation copy to avoid wall-clock
+aging during the run; the policy MFA limits were unchanged. Embedded policy
+validation/tests also passed. Candidate package digest:
+`sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7`.
+Evidence: `docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json`
+and `docs/evidence/2026-10-03-provisioning-window-admission-candidate.json`.