{
  "schema_version": "1.0",
  "policy_id": "credit-review-document-reader",
  "status": "example",
  "subject": {
    "agent_id": "credit-review-agent",
    "workload_id": "spiffe://bank.example/prod/credit-review",
    "delegated_user_required": true
  },
  "entitlements": {
    "tools": [
      "credit_application.read",
      "credit_memo.draft",
      "credit_decision.propose"
    ],
    "resources": [
      "credit-application:{case_id}"
    ],
    "data": {
      "fields": [
        "declared_income",
        "verified_income",
        "existing_exposure",
        "requested_amount"
      ],
      "denied_fields": [
        "special_category_data",
        "unrelated_household_records"
      ]
    },
    "actions": [
      "read",
      "draft",
      "propose_credit_decision"
    ],
    "purposes": [
      "credit_application_review"
    ],
    "amount": {
      "currency": "EUR",
      "approval_threshold": 25000,
      "authorization_ceiling": 100000
    },
    "environments": [
      "production"
    ],
    "time": {
      "maximum_token_lifetime_seconds": 900,
      "access_window": "case_assignment"
    }
  },
  "decision": {
    "allow_when": [
      "case_id matches the assigned case",
      "delegated user remains assigned and active",
      "all requested fields are allowed",
      "purpose equals credit_application_review",
      "requested amount is at or below EUR 25000",
      "token audience matches the target resource"
    ],
    "require_approval_when": [
      "the agent proposes a credit decision",
      "the requested amount exceeds EUR 25000 and is at or below EUR 100000"
    ],
    "block_when": [
      "identity, delegation, tenant, purpose, or audience is missing",
      "the credential, assignment, entitlement, or policy is expired",
      "the request targets an unassigned case or forbidden field",
      "the requested amount exceeds EUR 100000",
      "the destination or purpose differs from the authorized values",
      "the policy decision service cannot produce the required verdict"
    ]
  },
  "evidence": [
    "principal_id",
    "agent_identity_id",
    "workload_identity_id",
    "delegation_id",
    "tenant_id",
    "tool_id",
    "resource_id",
    "data_boundary_ref",
    "action",
    "purpose",
    "amount",
    "environment",
    "requested_at",
    "expires_at",
    "policy_id",
    "policy_version",
    "authentication_event_id",
    "authorization_decision_id",
    "policy_decision_id",
    "approval_decision_id",
    "reason_codes",
    "approval_id",
    "reviewer_id",
    "execution_receipt"
  ]
}