{
  "id": "01K4LOGIN00000000000000001",
  "version": 1,
  "schema_version": "0.2.0",
  "status": "awaiting_actor",
  "depth": 0,
  "title": "Login to Payroll-Prod / ACME",
  "question": "Log into Payroll-Prod as Bernd Worsch in tenant ACME?",
  "requested_act": "login",
  "binding_level": "organizational",
  "locale": "en",
  "created_at": "2026-09-09T08:01:00Z",
  "updated_at": "2026-09-09T08:01:00Z",
  "requester": {
    "id": "01K4SYSTEM00000000000000001",
    "kind": "system",
    "display_name": "Payroll-Prod IdP"
  },
  "subject": {
    "id": "01K4PERSONBERND00000000001",
    "kind": "person",
    "display_name": "Bernd Worsch"
  },
  "brief": "You are entering Payroll-Prod. Sessions are recorded. Privileges at the gate are identity-scoped, not hat-scoped.",
  "identity_context": {
    "system": "Payroll-Prod",
    "environment": "prod",
    "binding": {
      "principal": {
        "id": "01K4PERSONBERND00000000001",
        "kind": "person",
        "display_name": "Bernd Worsch",
        "role": "employee",
        "identifiers": [
          { "scheme": "email", "value": "bernd.worsch@example.com" },
          { "scheme": "idp:oidc-sub", "value": "auth.example.com|bernd" }
        ]
      },
      "available_identities": [
        {
          "id": "01K4PERSONBERND00000000001",
          "kind": "person",
          "display_name": "Bernd Worsch"
        },
        {
          "id": "01K4PERSONBERNDADMIN000001",
          "kind": "person",
          "display_name": "Bernd Worsch (break-glass)"
        }
      ],
      "target": {
        "kind": "tenant",
        "id": "tenant:acme",
        "label": "ACME Corp",
        "environment": "prod",
        "requires_new_bind": true
      },
      "available_bind_scopes": [
        {
          "kind": "tenant",
          "id": "tenant:acme",
          "label": "ACME Corp",
          "environment": "prod",
          "requires_new_bind": true
        },
        {
          "kind": "tenant",
          "id": "tenant:beta",
          "label": "Beta GmbH",
          "environment": "prod",
          "requires_new_bind": true
        }
      ],
      "granted_at_bind": {
        "roles": ["authenticated"],
        "permissions": ["session.create"]
      },
      "terms": {
        "monitoring": true,
        "consent_code": "LOGIN-PROD-2026"
      }
    },
    "awareness": {
      "proposed_hat": {
        "id": "hat:finance-controller",
        "label": "Finance Controller",
        "kind": "access_profile",
        "elevates": false,
        "scope_id": "tenant:acme"
      },
      "proposed_hat_source": "last_used",
      "available_hats": [
        {
          "id": "hat:finance-controller",
          "label": "Finance Controller",
          "kind": "access_profile",
          "elevates": false
        },
        {
          "id": "hat:auditor-readonly",
          "label": "Auditor (read-only)",
          "kind": "perspective",
          "elevates": false
        },
        {
          "id": "hat:payroll-admin",
          "label": "Payroll Admin",
          "kind": "role",
          "elevates": true
        }
      ],
      "available_scopes": [
        {
          "kind": "tenant",
          "id": "tenant:beta",
          "label": "Beta GmbH",
          "environment": "prod",
          "requires_new_bind": true
        }
      ],
      "last_session": {
        "ended_at": "2026-09-08T16:12:00Z",
        "hat_id": "hat:finance-controller",
        "scope_id": "tenant:acme"
      },
      "situation_note": "Last session Tuesday 18:12 CEST as Finance Controller in ACME."
    }
  },
  "packet": [],
  "highlights": [],
  "route": {
    "mode": "sequential",
    "steps": [
      {
        "id": "01K4LOGINSTEP0000000000001",
        "ordinal": 1,
        "kind": "acknowledge",
        "assignee": {
          "id": "01K4PERSONBERND00000000001",
          "kind": "person",
          "display_name": "Bernd Worsch"
        },
        "required_verbs": ["accept", "decline"],
        "min_binding_level": "organizational",
        "status": "active"
      }
    ],
    "current_step_ids": ["01K4LOGINSTEP0000000000001"]
  },
  "session": {
    "status": "pending"
  }
}