{"cast":{"issuerDid":"did:key:z6MkiAgB6qXXusCNd83aw7ezKGe3QaH9sFhKCivA3juXG2XB","buyerDid":"did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd","attackerDid":"did:key:z6MkgNBJtL7UZWdSXL5LzqReYaYQeBx7YNmKbsx8xKnqNmjd"},"policy":{"id":"supplier-default-policy","version":"1.0.0","action":"purchase-office-supplies","grantedMaxAmount":500},"beats":[{"id":"accepted","title":"Beat 1 — accepted (within granted authority)","asker":"Buyer did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd","askedFor":"purchase-office-supplies, amount=150","expected":"permitted","decision":{"stage":"policy","permitted":true,"provenDid":"did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd","explanation":{"outcome":"permitted","rule":{"ruleId":"R-purchase-office-supplies","description":"office-supply purchases are permitted up to a ceiling of 500 (the credential's own granted scope already matches this ceiling)"},"field":{"path":"credentialSubject.action","requested":"purchase-office-supplies","permitted":"purchase-office-supplies"},"narrative":"action \"purchase-office-supplies\" permitted under rule \"R-purchase-office-supplies\"; issuer did:key:z6MkiAgB6qXXusCNd83aw7ezKGe3QaH9sFhKCivA3juXG2XB; revocation checked and clean","caveats":[]},"envelope":{"action":"purchase-office-supplies","scope":{"amount":500},"issuer":"did:key:z6MkiAgB6qXXusCNd83aw7ezKGe3QaH9sFhKCivA3juXG2XB"}}},{"id":"over-scope","title":"Beat 2 — refused (over scope)","asker":"Buyer did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd","askedFor":"purchase-office-supplies, amount=5000","expected":"refused","decision":{"stage":"policy","permitted":false,"provenDid":"did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd","explanation":{"outcome":"refused","refusalKind":"over-scope","rule":{"ruleId":"credential:own-scope","description":"the presented authority credential's own granted scope"},"field":{"path":"scope.amount","requested":5000,"permitted":500},"narrative":"requested \"amount\" = 5000 exceeds the permitted maximum of 500 (source: the credential's own scope)","caveats":[]}}},{"id":"spoofed-identity","title":"Beat 3 — refused (spoofed identity)","asker":"Impostor claiming did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd (Attacker's real DID is did:key:z6MkgNBJtL7UZWdSXL5LzqReYaYQeBx7YNmKbsx8xKnqNmjd)","askedFor":"purchase-office-supplies, amount=100, presenting the Buyer's real credential","expected":"refused","decision":{"stage":"proof-of-possession","permitted":false,"claimedDid":"did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd","rule":{"ruleId":"gate:proof-of-possession","description":"the presenter must prove possession of the private key behind its claimed DID by signing this session's fresh challenge (M1); possessing or copying the DID string alone proves nothing"},"field":{"path":"proof.signature","actual":"Signature verification failed for proof of possession of did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd"},"narrative":"did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd did not prove possession of the private key behind that DID over this session's fresh challenge (Signature verification failed for proof of possession of did:key:z6Mkq5CpexH7njsfUjD3ab4bJQnVe9ga4Xhoyeav8TRHZZwd) — a copied DID string proves nothing; only a signature nobody without the true private key could produce does, and this one does not verify against that DID's public key"}},{"id":"forged-credential","title":"Beat 4 — refused (forged credential)","asker":"Attacker did:key:z6MkgNBJtL7UZWdSXL5LzqReYaYQeBx7YNmKbsx8xKnqNmjd","askedFor":"purchase-office-supplies, amount=1000, presenting a credential it minted for itself","expected":"refused","decision":{"stage":"policy","permitted":false,"provenDid":"did:key:z6MkgNBJtL7UZWdSXL5LzqReYaYQeBx7YNmKbsx8xKnqNmjd","explanation":{"outcome":"refused","refusalKind":"untrusted-issuer","rule":{"ruleId":"gate:issuer-trust","description":"the credential's issuer must be a configured trust anchor, or vouched for by one (M4)"},"field":{"path":"issuerTrust.reason.kind","actual":"self-issued"},"narrative":"issuer did:key:z6MkgNBJtL7UZWdSXL5LzqReYaYQeBx7YNmKbsx8xKnqNmjd is the credential's own subject — self-issued authority is always refused","caveats":[]}}}]}