[ { "name": "alice reads tickets in her own tenant", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:100000", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "allow", "reason": [ "read-tools" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "alice writes tickets in her own tenant", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:110101", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "allow", "reason": [ "write-tools" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "injected write to another tenant is denied by tenant-isolation", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.globex\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:120202", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [ "tenant-isolation" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "same-tenant injected write is denied by request-scope", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:310000", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "deny", "reason": [ "request-scope" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "cross-tenant read is denied by tenant-isolation", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.globex\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:130303", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [ "tenant-isolation" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "user outside the bound tenant is denied by tenant-isolation", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.globex\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "globex" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:140404", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [ "tenant-isolation" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "bob's write is denied by default: no permit matched and no forbid fired", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "bob" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:150505", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy without approval is denied by destructive-needs-approval", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:160606", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [ "destructive-needs-approval" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved by the requester is denied by destructive-needs-approval", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:170707", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "alice" } }, "approval_for": "sha256:170707", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "deny", "reason": [ "destructive-needs-approval" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved from another tenant is denied by destructive-needs-approval", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:180808", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "carol" } }, "approval_for": "sha256:180808", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "deny", "reason": [ "destructive-needs-approval" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved by a second user of the tenant is allowed", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:190909", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "dana" } }, "approval_for": "sha256:190909", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "allow", "reason": [ "write-tools" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved by a second user without the write grant is denied by destructive-needs-approval", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:1a0a0a", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "bob" } }, "approval_for": "sha256:1a0a0a", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "deny", "reason": [ "destructive-needs-approval" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved by dana for a different call is denied by approval-matches-call", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:320000", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "dana" } }, "approval_for": "sha256:2b2b2b", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "deny", "reason": [ "approval-matches-call" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved by dana after the approval expired is denied by approval-is-fresh", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:330000", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "dana" } }, "approval_for": "sha256:330000", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:00:00-0400" } } } }, "decision": "deny", "reason": [ "approval-is-fresh" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "destroy approved by dana without the hash it was given for binds nothing: denied by approval-matches-call", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:340000", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "approved_by": { "__entity": { "type": "User", "id": "dana" } }, "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "deny", "reason": [ "approval-matches-call" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "triage-worker reads after one hand-off", "request": { "principal": "Agent::\"triage-worker\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 1, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:1b0b0b", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "allow", "reason": [ "read-tools" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "triage-worker's write is denied by request-scope: its delegated scope is read only", "request": { "principal": "Agent::\"triage-worker\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 1, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:1c0c0c", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "deny", "reason": [ "request-scope" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "a token scope wider than triage-worker's grant still gives it no write", "request": { "principal": "Agent::\"triage-worker\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 1, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:1d0d0d", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "triage-worker's injected write to another tenant is denied by tenant-isolation and request-scope", "request": { "principal": "Agent::\"triage-worker\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.globex\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 1, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:1e0e0e", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "deny", "reason": [ "tenant-isolation", "request-scope" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "support-assistant's write under a read-only delegated scope is denied by request-scope", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:1f0f0f", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "deny", "reason": [ "request-scope" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "a read under a write-only delegated scope is denied by request-scope", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:201010", "delegated_read_groups": [], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [ "request-scope" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "an approved destroy outside the delegated write scope is denied by request-scope", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"destroy\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:211111", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [], "approved_by": { "__entity": { "type": "User", "id": "dana" } }, "approval_for": "sha256:211111", "approval_expires": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:20:00-0400" } } } }, "decision": "deny", "reason": [ "request-scope" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "read after two hand-offs, the depth limit, is allowed", "request": { "principal": "Agent::\"triage-worker\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 2, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:221212", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "allow", "reason": [ "read-tools" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "read after a third hand-off is denied by delegation-depth", "request": { "principal": "Agent::\"triage-worker\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 3, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:231313", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [] } }, "decision": "deny", "reason": [ "delegation-depth" ], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "an agent without the read grant is denied by default", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:241414", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "a user without the read grant is denied by default", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "bob" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:251515", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "a tenant that has not enabled read is denied by default", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"read\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:261616", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] }, { "name": "a tenant that has not enabled write is denied by default", "request": { "principal": "Agent::\"support-assistant\"", "action": "Action::\"write\"", "resource": "Tool::\"tickets.acme\"", "context": { "user": { "__entity": { "type": "User", "id": "alice" } }, "tenant": { "__entity": { "type": "Tenant", "id": "acme" } }, "depth": 0, "now": { "__extn": { "fn": "datetime", "arg": "2026-10-27T09:12:00-0400" } }, "request_hash": "sha256:271717", "delegated_read_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ], "delegated_write_groups": [ { "__entity": { "type": "ToolGroup", "id": "tickets" } } ] } }, "decision": "deny", "reason": [], "num_errors": 0, "entities": [ {"uid":{"type":"ToolGroup","id":"tickets"},"attrs":{},"parents":[]}, {"uid":{"type":"Tenant","id":"acme"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tenant","id":"globex"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"User","id":"alice"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"bob"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"dana"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"acme"}]}, {"uid":{"type":"User","id":"carol"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[{"type":"Tenant","id":"globex"}]}, {"uid":{"type":"Agent","id":"support-assistant"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}]},"parents":[]}, {"uid":{"type":"Agent","id":"triage-worker"},"attrs":{"read_groups":[{"__entity":{"type":"ToolGroup","id":"tickets"}}],"write_groups":[]},"parents":[]}, {"uid":{"type":"Tool","id":"tickets.acme"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"acme"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]}, {"uid":{"type":"Tool","id":"tickets.globex"},"attrs":{"tenant":{"__entity":{"type":"Tenant","id":"globex"}}},"parents":[{"type":"ToolGroup","id":"tickets"}]} ] } ]