{
  "schema": "ci-app-access-test-vectors/v1",
  "description": "Synthetic stable subjects only. Each vector is complete and portable to Python/PHP.",
  "vectors": [
    {
      "name": "uncapped_inherits_current_view",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "explicit_window_above_desktop",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "window_role": "admin"
      },
      "expected": {
        "allowed": true,
        "effective_role": "admin",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "explicit_window_below_desktop",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true,
        "window_role": "customer"
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "account_ceiling_restricts_explicit_window",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "developer",
        "binding_valid": true,
        "window_role": "admin"
      },
      "expected": {
        "allowed": true,
        "effective_role": "developer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "app_ceiling",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "max_role": "customer"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "personal_ceiling",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "wp:user-a": "customer"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "other_user_cap_does_not_apply",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "wp:user-b": "customer"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "admin",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "transport_ceiling",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true,
        "connection_max_role": "developer"
      },
      "expected": {
        "allowed": true,
        "effective_role": "developer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "independent_channel_view_developer",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "developer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "developer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "minimum_met",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "min_role": "developer"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "developer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "developer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "minimum_not_met",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "min_role": "developer"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "minimum_not_met",
        "policy_revision": 1
      }
    },
    {
      "name": "personal_cap_below_minimum_only_denies_user",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "min_role": "developer",
        "user_max_roles": {
          "wp:user-a": "customer"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "minimum_not_met",
        "policy_revision": 1
      }
    },
    {
      "name": "other_user_below_minimum_does_not_invalidate",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "min_role": "developer",
        "user_max_roles": {
          "wp:user-b": "customer"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "admin",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "empty_allowlist_denies",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": []
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "user_not_allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "allowlist_matches_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:user-a"
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "allowlist_different_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:user-b"
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "user_not_allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "allowlist_no_casefold",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "WP:USER-A"
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "user_not_allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "allowlist_no_trimming",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          " wp:user-a "
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "user_not_allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "inactive_authenticated_account",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": false,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "inactive_account",
        "policy_revision": 1
      }
    },
    {
      "name": "inactive_cannot_downgrade_to_guest",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": false,
        "authenticated": true,
        "view_role": "guest",
        "account_max_role": "admin",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "inactive_account",
        "policy_revision": 1
      }
    },
    {
      "name": "invalid_or_expired_binding",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": false
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "binding_invalid",
        "policy_revision": 1
      }
    },
    {
      "name": "owner_denial_intersects",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "owner_allowed": false
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "owner_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "legacy_denial_intersects",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "legacy_denied": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "legacy_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "allowlist_does_not_override_owner",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:user-a"
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "owner_allowed": false
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "owner_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "legacy_noncontiguous_direct_admin",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true,
        "legacy_roles": [
          "customer",
          "admin"
        ]
      },
      "expected": {
        "allowed": true,
        "effective_role": "admin",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "legacy_noncontiguous_clamp_does_not_invent_developer",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "max_role": "developer"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true,
        "legacy_roles": [
          "customer",
          "admin"
        ]
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "role_not_granted",
        "policy_revision": 1
      }
    },
    {
      "name": "legacy_empty_roles_denies",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "legacy_roles": []
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "role_not_granted",
        "policy_revision": 1
      }
    },
    {
      "name": "guest_view_requires_flag",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "guest",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "guest_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "guest_view_allowed_explicitly",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "guest",
        "account_max_role": "admin",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "guest",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "cap_to_guest_requires_flag",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "max_role": "guest"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "guest_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "cap_to_guest_allowed_explicitly",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "max_role": "guest"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "guest",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "explicit_guest_requires_flag",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "window_role": "guest"
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "guest_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "explicit_admin_above_guest_desktop",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "guest",
        "account_max_role": "admin",
        "binding_valid": true,
        "window_role": "admin"
      },
      "expected": {
        "allowed": true,
        "effective_role": "admin",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_guest_explicitly_enabled",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "guest",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_guest_missing_permission",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": false
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "guest_denied",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_cannot_match_user_allowlist",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:user-a"
        ]
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "user_not_allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_cannot_claim_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_cannot_claim_account_admin",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "admin",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_cannot_claim_view_admin",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": false,
        "view_role": "admin",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_cannot_claim_window_admin",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": true,
        "window_role": "admin"
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "optional_null_roles_are_absent",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "window_role": null,
        "connection_max_role": null,
        "legacy_roles": null
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "policy_revision_preserved",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 12
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 12
      }
    },
    {
      "name": "missing_context_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "missing_context_active",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "missing_context_authenticated",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "missing_context_view_role",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "missing_context_account_max_role",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "missing_context_binding_valid",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin"
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "empty_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": " ",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "null_authenticated_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "numeric_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": 7,
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "numeric_active",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": 1,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "string_binding",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": "true"
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "unknown_role",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "owner",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "numeric_guest_flag",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "guest_access": 1
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "invalid_optional_role",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "window_role": "OWNER"
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "duplicate_legacy_roles",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "legacy_roles": [
          "customer",
          "customer"
        ]
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "unknown_context_trusted_flag",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true,
        "trusted": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "wrong_schema",
      "policy": {
        "schema": "ci-app-access-policy/v2",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "empty_app_id",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": " ",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "zero_revision",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 0
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "boolean_revision",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": true
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "unknown_policy_field",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "ttl": 120
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "global_min_above_max",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "min_role": "admin",
        "max_role": "customer"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "null_max_not_absent",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "max_role": null
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "duplicate_allowed_users",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:user-a",
          "wp:user-a"
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "invalid_allowed_user",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          ""
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "null_allowlist_not_absent",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": null
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "invalid_personal_role",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "wp:user-a": "owner"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "invalid_personal_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "": "customer"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "personal_roles_must_be_object",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": []
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "allowed_users_must_be_array",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": {}
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "policy_null",
      "policy": null,
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "policy_list",
      "policy": [],
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "context_null",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": null,
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "context_list",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": [],
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "anonymous_has_no_active_account",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": null,
        "active": false,
        "authenticated": false,
        "view_role": "guest",
        "account_max_role": "guest",
        "binding_valid": true,
        "guest_access": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "guest",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "unicode_whitespace_app_id",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "  ",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "unicode_whitespace_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "  ",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "unicode_subject_exact",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:prüfer"
        ]
      },
      "context": {
        "subject": "wp:prüfer",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "numeric_subject_zero_cap",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "0": "customer"
        }
      },
      "context": {
        "subject": "0",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "numeric_subject_leading_zero_exact",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "01": "customer"
        }
      },
      "context": {
        "subject": "1",
        "active": true,
        "authenticated": true,
        "view_role": "admin",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "admin",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "control_in_app_id",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "app\u0000id",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "control_in_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:\u0000user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "control_in_allowlist",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "allowed_users": [
          "wp:\u0000user-a"
        ]
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "control_in_personal_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1,
        "user_max_roles": {
          "wp:\u0001user-a": "customer"
        }
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "del_in_subject",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_context",
        "policy_revision": 1
      }
    },
    {
      "name": "del_in_app_id",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "appid",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "fractional_revision",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1.5
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "integral_json_number_revision",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 1
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 1
      }
    },
    {
      "name": "maximum_safe_revision",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 9007199254740991
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": true,
        "effective_role": "customer",
        "reason": "allowed",
        "policy_revision": 9007199254740991
      }
    },
    {
      "name": "unsafe_revision_rejected",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": 9007199254740992
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    },
    {
      "name": "string_revision_rejected",
      "policy": {
        "schema": "ci-app-access-policy/v1",
        "app_id": "system.channel-manager",
        "revision": "1"
      },
      "context": {
        "subject": "wp:user-a",
        "active": true,
        "authenticated": true,
        "view_role": "customer",
        "account_max_role": "admin",
        "binding_valid": true
      },
      "expected": {
        "allowed": false,
        "effective_role": null,
        "reason": "invalid_policy",
        "policy_revision": null
      }
    }
  ]
}