{
  "id": "decision:345172e88988026a",
  "contract_version": "flex-auth.decision-record.v1",
  "effect": "allow",
  "reason": "exact_task_execution_matched",
  "matched_policy_version": "v2",
  "matched_rule": "exact_task_execution_matched",
  "resource": {
    "id": "catalog:synthetic",
    "type": "secret-catalog-lane",
    "system": "secrets-engine",
    "tenant": "tenant:platform",
    "attributes": {
      "stage": "prod"
    }
  },
  "subject": {
    "id": "secrets-engine",
    "type": "service",
    "tenant": "tenant:platform"
  },
  "binding": {
    "tenant": "tenant:platform",
    "subject": {
      "id": "secrets-engine",
      "type": "service",
      "tenant": "tenant:platform"
    },
    "action": "execute-ccr",
    "resource": {
      "id": "catalog:synthetic",
      "type": "secret-catalog-lane",
      "system": "secrets-engine",
      "tenant": "tenant:platform",
      "attributes": {
        "stage": "prod"
      }
    },
    "context": {
      "approval": {
        "approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
        "binding": {
          "action": "execute-ccr",
          "actor": "secrets-engine",
          "digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
          "human_control": true,
          "pdp_digest": "sha256:1314ecedf5f8607a41ac4b5f951a4f47460ff4a6fecff70b057698688a5e71e4",
          "pdp_path": true,
          "principal": "secrets-engine",
          "purpose": "actual Python App source-only synthetic proof",
          "target": {
            "attributes": {
              "stage": "prod"
            },
            "id": "catalog:synthetic",
            "system": "secrets-engine",
            "tenant": "tenant:platform",
            "type": "secret-catalog-lane"
          }
        },
        "consumed": false,
        "freshness": {
          "not_after": "2026-10-16T14:39:10+00:00",
          "observed_at": "2026-10-16T14:37:10+00:00",
          "ttl_seconds": 120
        },
        "issuer": "approval-engine",
        "kind": "approval-claim",
        "reason_code": "ok",
        "schema_version": "0.1",
        "state": "valid",
        "valid_now": true,
        "validity": {
          "expires_at": "2026-10-16T14:40:10.168539+00:00",
          "not_before": "2026-10-16T14:36:10.168539+00:00"
        },
        "yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
      },
      "catalog_target": {
        "lane": "synthetic",
        "stage": "prod"
      },
      "execution_contract": {
        "backend_budget": {
          "ttl_seconds": 30,
          "uses": 12
        },
        "backend_origin": "http://127.0.0.1:18200",
        "catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc",
        "ccr_id": "CCR-2099-0001",
        "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "cluster_uid": "synthetic-not-native",
        "contract_version": "SECRETS-EXEC-20261011-v1",
        "execution_actor": "service:secrets-engine",
        "execution_grant_ccr_id": "CCR-2099-0002",
        "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "operation": "metadata-apply-ccr",
        "operation_deadline": "2026-10-16T14:38:10+00:00",
        "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
        "operations": [
          {
            "method": "GET",
            "path": "sys/policies/acl/synthetic",
            "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          {
            "method": "PUT",
            "path": "sys/policies/acl/synthetic",
            "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          {
            "method": "GET",
            "path": "sys/policies/acl/synthetic",
            "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          {
            "method": "GET",
            "path": "auth/synthetic/role/synthetic",
            "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          {
            "method": "PUT",
            "path": "auth/synthetic/role/synthetic",
            "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          {
            "method": "GET",
            "path": "auth/synthetic/role/synthetic",
            "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          }
        ],
        "source_bundle": {
          "engine_dispatcher": {
            "path": "/synthetic/engine_dispatcher.py",
            "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "platform_mediator": {
            "path": "/synthetic/platform_mediator.py",
            "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "policy_auth": {
            "path": "/synthetic/policy_auth.py",
            "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "typed_ccr": {
            "path": "/synthetic/typed_ccr.py",
            "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          }
        }
      },
      "human_control": true,
      "purpose": "actual Python App source-only synthetic proof",
      "service_actor_binding": {
        "subject_id": "secrets-engine",
        "subject_type": "service",
        "tenant": "tenant:platform",
        "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
        "version": "proposed-service-task-caller/v1"
      }
    },
    "request_digest": "sha256:5de47c87ba31a96c51cffd75e3a1236a830745c9bf2087d5a44b640b40c11540",
    "approval_binding_digest": "sha256:1314ecedf5f8607a41ac4b5f951a4f47460ff4a6fecff70b057698688a5e71e4",
    "submitted_request_digest": "sha256:5de47c87ba31a96c51cffd75e3a1236a830745c9bf2087d5a44b640b40c11540"
  },
  "lifetime": {
    "kind": "ttl",
    "ttl": "59.254796424s",
    "not_before": "2026-10-16T14:37:10.745203576Z",
    "expires_at": "2026-10-16T14:38:10Z"
  },
  "diagnostics": {
    "action": "execute-ccr",
    "matched_relationship": "",
    "policy_package": "secrets-engine.task-execution.service-pilot",
    "policy_status": "proposed",
    "registry_overrode": [],
    "registry_resource": false,
    "registry_subject": false
  },
  "provenance": {
    "evaluator": "flex-auth/local",
    "mode": "standalone",
    "policy_package": "secrets-engine.task-execution.service-pilot",
    "policy_version": "v2",
    "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
    "registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
    "input_claim_digests": {
      "context": "sha256:1000c59c0b5765bc2de159a42c0cfa861ce840547e87edb5cadd8de20f177a31"
    },
    "decision_time": "2026-10-16T14:37:10Z",
    "approval_observation": {
      "source_id": "synthetic-actual-approval-app",
      "source_revision": "actual-owner-python-source-fixture",
      "configuration_digest": "sha256:b646af61ef4d13a89c82a267d93b38eab6bcfc3ba0314550577dd883bdd221a2",
      "claim_digest": "sha256:dfeec32f189bc8ed5500bc1f7a53758183cd889ee9472dc8ee5d506dd5c67393",
      "native_binding_digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
      "observed_at": "2026-10-16T14:37:10Z",
      "not_after": "2026-10-16T14:39:10Z",
      "validated_at": "2026-10-16T14:37:10.733320979Z"
    },
    "caller": {
      "mode": "enforce",
      "principal": "system:serviceaccount:secrets-engine:secrets-engine",
      "audience": "flex-auth",
      "not_after": "2026-10-16T14:39:10Z"
    }
  },
  "signature": {
    "mode": "signed",
    "alg": "ed25519",
    "kid": "synthetic-v2",
    "value": "XP7oAYq5QDFThW8NkQunirFEcCmOwqkxeJiaQWbJGdi--x2XEVOtJH_mZmAQGeTXmcZGWS6WNtNVltgD2NxVDA"
  },
  "caring": {
    "profile": "caring-0.4.0-rc2",
    "conformance_findings": [
      {
        "code": "CARING-DESCRIPTOR-MISSING",
        "severity": "warning",
        "message": "no CARING descriptor matched the request",
        "fields": [
          "caring_context"
        ]
      }
    ]
  }
}