{
  "image": "sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
  "pod": "flex-auth-secrets-engine-6467b96c6f-ncl5t",
  "scope": "PDP evaluation only; synthetic claim, no approval consume or OpenBao access",
  "checks": {
    "native_request_preserved": true,
    "missing_caller_refused": true,
    "wrong_caller_refused": true,
    "foreign_owner_representation_refused": true,
    "wrong_tenant_denied": true,
    "recipient_cannot_be_lifecycle_subject": true,
    "producer_approval_digest_pair": true,
    "changed_path_cannot_reuse_approval_digest": true,
    "changed_mount_cannot_reuse_approval_digest": true,
    "changed_repo_cannot_reuse_approval_digest": true,
    "other_deployment_specs_unchanged": true
  },
  "decision_id": "decision:e8bec2d72f7df007",
  "forward_stopped": true,
  "caller_token_handling": "10 minute audience-bound tokens held in memory only; expire at issuer, not revoked by dropping local references",
  "consumer_validation": "Actual secrets-engine validate_decision_envelope accepted the live response against the exact submission and v2 pin."
}