{
  "format": "vercy-model-allocation-candidate/v1",
  "contourId": "EM-RSK-03",
  "proposedName": "Authorization Domain / Access Grant",
  "modelId": null,
  "registryId": null,
  "allocationState": "unassigned",
  "allocationBoundaryState": "unresolved-cluster",
  "decision": "NEW MODEL CANDIDATE CLUSTER",
  "canonicalPublishable": false,
  "candidateRevision": 3,
  "boundary": {
    "owns": [
      "candidate authorization-domain identity and policy namespace",
      "candidate reusable access-role definitions and immutable revisions",
      "candidate time-bounded role assignments",
      "candidate issued permission-grant identity and lifecycle",
      "candidate delegated-grant ancestry and attenuation",
      "revocation, expiry and propagation state"
    ],
    "references": [
      {
        "target": "WM-XCT-016",
        "purpose": "identity-register anchor"
      },
      {
        "target": "WM-VRT-005",
        "purpose": "digital account profile direction; usable specification absent"
      },
      {
        "target": "WM-XCT-002",
        "purpose": "consent or read/disclosure justification only"
      },
      {
        "target": "WM-XCT-001",
        "purpose": "holder/steward and scoped control mandate only"
      },
      {
        "target": "WM-ACT-034",
        "purpose": "Access Review activity profile"
      },
      {
        "target": "WM-XCT-004",
        "purpose": "append-only audit evidence; usable specification absent"
      },
      {
        "target": "WM-XCT-007",
        "purpose": "enforcement neighbor; usable specification absent"
      },
      {
        "target": "WM-XCT-017",
        "purpose": "issued credential or attestation identity, distinct from account authenticator metadata"
      }
    ],
    "excludes": [
      "person, identity-register or account identity",
      "organizational role or position mastership",
      "consent lifecycle and legal-basis determination",
      "review conclusion as automatic revocation",
      "credential secret values or reversible representations",
      "authenticator issuance and secret-store lifecycle",
      "security incident and enforcement lifecycle"
    ]
  },
  "objects": {
    "AuthorizationDomain": {
      "identity": [
        "authorizationDomainId"
      ],
      "required": [
        "ownerRef",
        "policyBoundaryRef",
        "status"
      ],
      "lifecycle": [
        "draft",
        "approved",
        "active",
        "suspended",
        "retired",
        "superseded"
      ]
    },
    "AccessRole": {
      "identity": [
        "authorizationDomainId",
        "accessRoleId"
      ],
      "required": [
        "roleRevision",
        "actionSet",
        "resourceScope",
        "contentDigest",
        "status"
      ],
      "lifecycle": [
        "draft",
        "approved",
        "active",
        "suspended",
        "retired",
        "superseded"
      ]
    },
    "RoleAssignment": {
      "identity": [
        "roleAssignmentId"
      ],
      "required": [
        "accountRef",
        "accessRoleRevisionRef",
        "justificationRefs",
        "validFrom",
        "status"
      ],
      "optional": [
        "validTo",
        "workAssignmentRef"
      ],
      "lifecycle": [
        "proposed",
        "active",
        "suspended",
        "expired",
        "revoked"
      ]
    },
    "PermissionGrant": {
      "identity": [
        "grantId"
      ],
      "required": [
        "principalRef",
        "principalKind",
        "actions",
        "resourceScope",
        "authorityBasisRef",
        "justifications",
        "validFrom",
        "status",
        "effectiveAt",
        "propagationStatus",
        "auditCorrelationRef"
      ],
      "optional": [
        "conditions",
        "purpose",
        "attributeConstraints",
        "validTo",
        "sourceGrantRef",
        "roleAssignmentRef",
        "consentRef",
        "revokedAt",
        "revocationReason",
        "revocationCauseRef",
        "propagationDeadline"
      ],
      "lifecycle": [
        "draft",
        "approved",
        "active",
        "suspended",
        "expired",
        "revoked",
        "superseded"
      ],
      "principalKindValues": [
        "digital-account",
        "access-role"
      ],
      "propagationStatusValues": [
        "not-required",
        "pending",
        "complete",
        "partial",
        "failed"
      ],
      "justificationShape": {
        "required": [
          "kind",
          "sourceRef",
          "state",
          "validFrom"
        ],
        "optional": [
          "validTo",
          "withdrawnAt"
        ],
        "kindValues": [
          "role-assignment",
          "consent",
          "delegated-authority",
          "direct-mandate"
        ],
        "stateValues": [
          "live",
          "withdrawn",
          "expired",
          "unevaluable"
        ]
      }
    },
    "DelegatedGrant": {
      "extends": "PermissionGrant",
      "identity": [
        "grantId"
      ],
      "required": [
        "sourceGrantRef",
        "depth",
        "subdelegationPermitted",
        "attenuationProofRef"
      ],
      "optional": [
        "propagationDeadline"
      ],
      "lifecycle": [
        "draft",
        "approved",
        "active",
        "suspended",
        "expired",
        "revoked",
        "superseded"
      ]
    }
  },
  "invariantRules": [
    {
      "id": "EM-RSK-03.AD-01",
      "text": "Person, identity anchor, digital account and principal reference remain linked but never equated."
    },
    {
      "id": "EM-RSK-03.AD-02",
      "text": "WM-PER-002 duplicate retirement into WM-XCT-016 is a proposal that requires registry-owner alias confirmation and creates no account identity."
    },
    {
      "id": "EM-RSK-03.AD-03",
      "text": "An IAM access role is never inferred from an organizational role, title or position."
    },
    {
      "id": "EM-RSK-03.AD-04",
      "text": "Authorization Domain, Access Role, Role Assignment, Permission Grant and Delegated Grant have distinct identity and lifecycle semantics; this offline cluster does not prove one aggregate root."
    },
    {
      "id": "EM-RSK-03.AD-05",
      "text": "Every effective grant states principal, authority basis, one or more live justifications, actions, resource scope, conditions and validity."
    },
    {
      "id": "EM-RSK-03.AD-06",
      "text": "A delegated grant is a strict or equal subset of source actions, resource scope, purpose, attributes and validity and preserves or strengthens source conditions."
    },
    {
      "id": "EM-RSK-03.AD-07",
      "text": "Grant widening creates a new root grant with independent authority and justification; it never mutates a delegated child."
    },
    {
      "id": "EM-RSK-03.AD-08",
      "text": "Revoking or expiring a source grant invalidates all active descendants; revoking a child does not revoke its parent or separately justified siblings."
    },
    {
      "id": "EM-RSK-03.AD-09",
      "text": "Delegation records depth, expiry and whether sub-delegation is permitted, and rejects cycles."
    },
    {
      "id": "EM-RSK-03.AD-10",
      "text": "Consent may justify a read or disclosure grant but never creates general IAM capability or proves write/action authorization."
    },
    {
      "id": "EM-RSK-03.AD-11",
      "text": "Removing a role or work assignment invalidates only grants for which that assignment was the sole remaining live justification."
    },
    {
      "id": "EM-RSK-03.AD-12",
      "text": "An Access Review conclusion records retain, revoke, recertify or escalate and changes access only through a separate effective grant transition."
    },
    {
      "id": "EM-RSK-03.AD-13",
      "text": "Reviewer authority and delegation are governance authority and never create access rights."
    },
    {
      "id": "EM-RSK-03.AD-14",
      "text": "Credential metadata stores type, issuer, validity, assurance, status, key identifier, binding and protected reference only; secret values and reversible representations are prohibited."
    },
    {
      "id": "EM-RSK-03.AD-15",
      "text": "Identity-register keyBinding, account authenticator metadata and WM-XCT-017 issued credential or attestation remain separate and cross-referenced."
    },
    {
      "id": "EM-RSK-03.AD-16",
      "text": "Credential-status revocation, grant revocation, assignment termination, consent withdrawal and review decision are separate events with explicit causal links."
    },
    {
      "id": "EM-RSK-03.AD-17",
      "text": "Cached sessions and tokens cannot remain authorized beyond the supporting grant validity or revocation propagation deadline."
    },
    {
      "id": "EM-RSK-03.AD-18",
      "text": "Every approval, exercise, review, suspension, expiry and revocation correlates to append-only audit evidence without secret material."
    },
    {
      "id": "EM-RSK-03.AD-19",
      "text": "Projections contain only grant, justification and status metadata allowed by disclosure policy and never grant authority by their existence."
    },
    {
      "id": "EM-RSK-03.AD-20",
      "text": "Retired domain, role, assignment and grant identifiers remain resolvable and are never recycled."
    },
    {
      "id": "EM-RSK-03.AD-21",
      "text": "Changing an access role action set, resource scope, conditions or content digest creates an immutable successor role revision; assignments resolve an explicit role revision and history remains resolvable."
    },
    {
      "id": "EM-RSK-03.AD-22",
      "text": "An unevaluable authorization condition or justification is distinct from unsatisfied, raises an alert and fails closed; absent purpose or attribute constraints are undefined unless the source explicitly declares them unbounded."
    },
    {
      "id": "EM-RSK-03.AD-23",
      "text": "A grant principal is a Digital Account or Access Role reference with an explicit principal kind; Person and identity-register anchors are never direct grant principals."
    },
    {
      "id": "EM-RSK-03.AD-24",
      "text": "Partial or failed revocation propagation is a first-class non-success state with deadline, causal link and audit correlation; it never counts as completed revocation."
    }
  ],
  "holds": [
    "The candidate cluster is not one proven aggregate type; registry allocation must resolve Domain/Role/Assignment/Grant root boundaries.",
    "Per-type mastership and the Domain/Role/Assignment/Grant allocation split require registry-owner confirmation.",
    "No registry namespace or identifier is allocated and none may be guessed.",
    "WM-PER-002 duplicate retirement requires registry-owner alias confirmation.",
    "WM-VRT-005 and WM-XCT-004/007 lack usable complete specifications.",
    "WM-ACT-034 has no approved Access Review profile.",
    "Credential Metadata versus identity-register keyBinding versus WM-XCT-017 requires an approved semantic crosswalk.",
    "Approved relations, rights controls, package conversion and live conformance remain pending."
  ],
  "publicationStatement": "Research candidate cluster only; not canonically publishable, installable, allocated or verified.",
  "clusterIdentityTest": {
    "scope": "Offline allocation research cluster only; no aggregate root is asserted.",
    "perObject": {
      "AuthorizationDomain": {
        "identity": [
          "authorizationDomainId"
        ],
        "mastership": "IAM policy-domain authority",
        "lifecycle": [
          "draft",
          "approved",
          "active",
          "suspended",
          "retired",
          "superseded"
        ]
      },
      "AccessRole": {
        "identity": [
          "authorizationDomainId",
          "accessRoleId"
        ],
        "versionIdentityRule": "EM-RSK-03.AD-21",
        "mastership": "IAM role-catalogue authority",
        "lifecycle": [
          "draft",
          "approved",
          "active",
          "suspended",
          "retired",
          "superseded"
        ]
      },
      "RoleAssignment": {
        "identity": [
          "roleAssignmentId"
        ],
        "mastership": "IAM assignment authority",
        "lifecycle": [
          "proposed",
          "active",
          "suspended",
          "expired",
          "revoked"
        ]
      },
      "PermissionGrant": {
        "identity": [
          "grantId"
        ],
        "mastership": "IAM grant authority",
        "lifecycle": [
          "draft",
          "approved",
          "active",
          "suspended",
          "expired",
          "revoked",
          "superseded"
        ]
      },
      "DelegatedGrant": {
        "identity": [
          "grantId"
        ],
        "mastership": "IAM grant authority",
        "lifecycle": [
          "draft",
          "approved",
          "active",
          "suspended",
          "expired",
          "revoked",
          "superseded"
        ]
      }
    },
    "externalMastership": {
      "identityRegister": "identity registrar via WM-XCT-016",
      "digitalAccount": "platform/account operator; pending WM-VRT-005 completion",
      "credentialOrAttestation": "issuer via WM-XCT-017",
      "secretMaterial": "external authenticator or secret-store authority"
    }
  },
  "interimDisposition": {
    "WM-PER-002": {
      "currentAuthority": "WM-PER-002 remains reserved and non-canonical until registry-owner adjudication.",
      "preferredProposal": "confirm alias and retire duplicate pointer into WM-XCT-016 without creating an account identity",
      "fallbackIfAliasRejected": "scope-narrow and retitle WM-PER-002 as a distinct identity-anchor record; do not retire or merge",
      "providerDivergence": "Grok conditionally accepts retirement; Claude requires narrowing until confirmation."
    }
  }
}