{
  "about": "Conformance corpus for flowdesk-authz-kernel v1.0. Each case evaluates `policy` against `request` and must yield `expect` (permit|deny). Covers deny-overrides, attribute-to-attribute ref comparisons, fail-closed defaults, and the proto-pollution guard. Run: node conformance/run-authz.js",
  "policy": {
    "id": "tasks-abac-v1",
    "default": "deny",
    "rules": [
      { "id": "deny-confidential", "effect": "deny", "description": "confidential resources require the confidential clearance",
        "when": { "all": [ {"attr":"resource.tags","op":"contains","value":"confidential"}, {"not":{"attr":"subject.clearances","op":"contains","value":"confidential"}} ] } },
      { "id": "deny-quiet-hours", "effect": "deny", "description": "writes are blocked during a maintenance window",
        "when": { "all": [ {"attr":"action","op":"eq","value":"write"}, {"attr":"context.maintenance","op":"eq","value":true} ] } },
      { "id": "permit-read-own-ws", "effect": "permit",
        "when": { "all": [ {"attr":"action","op":"eq","value":"read"}, {"attr":"subject.workspace","op":"eq","value":{"ref":"resource.workspace"}} ] } },
      { "id": "permit-write-own", "effect": "permit",
        "when": { "all": [ {"attr":"action","op":"eq","value":"write"}, {"attr":"subject.did","op":"eq","value":{"ref":"resource.owner_did"}} ] } }
    ]
  },
  "cases": [
    { "name": "read own workspace", "expect": "permit",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["standard"]}, "action": "read", "resource": {"workspace":"ws1","tags":[]}, "context": {} } },
    { "name": "read other workspace -> default deny", "expect": "deny",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["standard"]}, "action": "read", "resource": {"workspace":"ws2","tags":[]}, "context": {} } },
    { "name": "write own task (attr-to-attr ref)", "expect": "permit",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["standard"]}, "action": "write", "resource": {"workspace":"ws1","owner_did":"did:flowdesk:a","tags":[]}, "context": {} } },
    { "name": "write someone else's task", "expect": "deny",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["standard"]}, "action": "write", "resource": {"workspace":"ws1","owner_did":"did:flowdesk:b","tags":[]}, "context": {} } },
    { "name": "deny-overrides: confidential beats read permit", "expect": "deny",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["standard"]}, "action": "read", "resource": {"workspace":"ws1","tags":["confidential"]}, "context": {} } },
    { "name": "confidential read WITH clearance", "expect": "permit",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["confidential"]}, "action": "read", "resource": {"workspace":"ws1","tags":["confidential"]}, "context": {} } },
    { "name": "write during maintenance window", "expect": "deny",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1","clearances":["standard"]}, "action": "write", "resource": {"workspace":"ws1","owner_did":"did:flowdesk:a","tags":[]}, "context": {"maintenance":true} } },
    { "name": "proto-pollution attr path is inert", "expect": "deny",
      "request": { "subject": {"did":"did:flowdesk:a","workspace":"ws1"}, "action": "read", "resource": {"workspace":"ws2"}, "context": {} } }
  ]
}