{
  "format": "vercy-enterprise-allocation-fixtures/v1",
  "contourId": "EM-RSK-03",
  "candidateName": "Authorization Domain / Access Grant",
  "candidateRevision": 3,
  "canonicalPublishable": false,
  "executable": false,
  "publicationStatement": "Research candidate cluster only; not canonically publishable, installable, allocated or verified.",
  "cases": [
    {
      "id": "EM-RSK-03.FX-001",
      "kind": "negative",
      "input": "A payroll account binding is imported as if the Person and identity anchor shared the account identifier.",
      "expect": "Reject equality; preserve three linked identities.",
      "rules": [
        "EM-RSK-03.AD-01"
      ]
    },
    {
      "id": "EM-RSK-03.FX-002",
      "kind": "negative",
      "input": "An operator retires WM-PER-002 before registry-owner alias confirmation.",
      "expect": "Reject retirement and keep the reservation unresolved.",
      "rules": [
        "EM-RSK-03.AD-02"
      ]
    },
    {
      "id": "EM-RSK-03.FX-003",
      "kind": "negative",
      "input": "A manager title automatically grants payroll write access.",
      "expect": "Reject the inferred IAM role and grant.",
      "rules": [
        "EM-RSK-03.AD-03"
      ]
    },
    {
      "id": "EM-RSK-03.FX-004",
      "kind": "negative",
      "input": "A package advertises Domain, Role, Assignment and Grant as one allocated aggregate type.",
      "expect": "Reject the root claim; the offline cluster remains allocation-unresolved.",
      "rules": [
        "EM-RSK-03.AD-04"
      ]
    },
    {
      "id": "EM-RSK-03.FX-005",
      "kind": "negative",
      "input": "Grant G has actions and scope but no live justification at effective time.",
      "expect": "Reject activation of G.",
      "rules": [
        "EM-RSK-03.AD-05"
      ]
    },
    {
      "id": "EM-RSK-03.FX-006",
      "kind": "negative",
      "input": "Child D adds delete and region B beyond source G.",
      "expect": "Reject D for failed attenuation.",
      "rules": [
        "EM-RSK-03.AD-06"
      ]
    },
    {
      "id": "EM-RSK-03.FX-007",
      "kind": "negative",
      "input": "A child grant is edited to widen scope after approval.",
      "expect": "Reject mutation; require a separately justified root grant.",
      "rules": [
        "EM-RSK-03.AD-07"
      ]
    },
    {
      "id": "EM-RSK-03.FX-008",
      "kind": "positive",
      "input": "Parent G is revoked while child D stays active; sibling S has an unrelated mandate.",
      "expect": "Revoke D, preserve separately justified S.",
      "rules": [
        "EM-RSK-03.AD-08"
      ]
    },
    {
      "id": "EM-RSK-03.FX-009",
      "kind": "negative",
      "input": "Delegation D points to itself and omits depth.",
      "expect": "Reject the cycle and incomplete delegation metadata.",
      "rules": [
        "EM-RSK-03.AD-09"
      ]
    },
    {
      "id": "EM-RSK-03.FX-010",
      "kind": "negative",
      "input": "Consent to disclose one record is used for general write access.",
      "expect": "Reject operational capability beyond read/disclosure.",
      "rules": [
        "EM-RSK-03.AD-10"
      ]
    },
    {
      "id": "EM-RSK-03.FX-011",
      "kind": "positive",
      "input": "Assignment A ends; G1 has only A, G2 has A plus live consent C.",
      "expect": "Invalidate G1 and preserve G2 subject to review.",
      "rules": [
        "EM-RSK-03.AD-11"
      ]
    },
    {
      "id": "EM-RSK-03.FX-012",
      "kind": "negative",
      "input": "Review R recommends revoke but no grant transition exists.",
      "expect": "Keep grant state unchanged and record pending transition.",
      "rules": [
        "EM-RSK-03.AD-12"
      ]
    },
    {
      "id": "EM-RSK-03.FX-013",
      "kind": "negative",
      "input": "A delegated reviewer receives the reviewed user's privileges.",
      "expect": "Reject access creation from reviewer mandate.",
      "rules": [
        "EM-RSK-03.AD-13"
      ]
    },
    {
      "id": "EM-RSK-03.FX-014",
      "kind": "negative",
      "input": "Metadata M contains an API secret and reversible encrypted password.",
      "expect": "Reject M; retain only protected reference and safe metadata.",
      "rules": [
        "EM-RSK-03.AD-14"
      ]
    },
    {
      "id": "EM-RSK-03.FX-015",
      "kind": "negative",
      "input": "An account authenticator record overwrites a WM-XCT-017 attestation.",
      "expect": "Reject merge; preserve separate subjects and cross-reference.",
      "rules": [
        "EM-RSK-03.AD-15"
      ]
    },
    {
      "id": "EM-RSK-03.FX-016",
      "kind": "negative",
      "input": "Credential status becomes revoked and system silently marks every grant revoked without cause links.",
      "expect": "Reject conflation; record separate causal events.",
      "rules": [
        "EM-RSK-03.AD-16"
      ]
    },
    {
      "id": "EM-RSK-03.FX-017",
      "kind": "negative",
      "input": "Cached token remains accepted after grant validity and propagation deadline.",
      "expect": "Reject authorization and record propagation failure.",
      "rules": [
        "EM-RSK-03.AD-17"
      ]
    },
    {
      "id": "EM-RSK-03.FX-018",
      "kind": "negative",
      "input": "Grant approval has no audit correlation and audit payload includes a secret.",
      "expect": "Reject approval evidence and secret payload.",
      "rules": [
        "EM-RSK-03.AD-18"
      ]
    },
    {
      "id": "EM-RSK-03.FX-019",
      "kind": "negative",
      "input": "A reporting projection is replayed as proof of authorization.",
      "expect": "Reject authority inference from projection.",
      "rules": [
        "EM-RSK-03.AD-19"
      ]
    },
    {
      "id": "EM-RSK-03.FX-020",
      "kind": "negative",
      "input": "A retired grant identifier is assigned to a new principal.",
      "expect": "Reject identifier recycling.",
      "rules": [
        "EM-RSK-03.AD-20"
      ]
    },
    {
      "id": "EM-RSK-03.FX-021",
      "kind": "negative",
      "input": "Role revision 3 mutates its action set in place while old assignments still cite revision 3.",
      "expect": "Reject mutation; create successor revision and retain history.",
      "rules": [
        "EM-RSK-03.AD-21"
      ]
    },
    {
      "id": "EM-RSK-03.FX-022",
      "kind": "negative",
      "input": "A condition cannot be evaluated and engine treats it as satisfied; parent purpose is absent and child invents one.",
      "expect": "Fail closed, alert, and treat absent constraint as undefined.",
      "rules": [
        "EM-RSK-03.AD-22"
      ]
    },
    {
      "id": "EM-RSK-03.FX-023",
      "kind": "negative",
      "input": "Grant principalKind is person and principalRef points to WM-PER-001.",
      "expect": "Reject direct person principal; require account or role.",
      "rules": [
        "EM-RSK-03.AD-23"
      ]
    },
    {
      "id": "EM-RSK-03.FX-024",
      "kind": "negative",
      "input": "One of three enforcement nodes misses revocation and propagation is marked complete.",
      "expect": "Mark partial non-success with deadline, cause and audit correlation.",
      "rules": [
        "EM-RSK-03.AD-24"
      ]
    },
    {
      "id": "EM-RSK-03.FX-025",
      "kind": "positive",
      "input": "Parent grants read/update for 30 days. Child cites attenuationProofRef P, grants read on one dataset for 7 days, depth 1, subdelegation false.",
      "expect": "Accept the child as an attenuated delegated grant.",
      "rules": [
        "EM-RSK-03.AD-06",
        "EM-RSK-03.AD-09"
      ]
    }
  ]
}