{
  "schemaVersion": "1.0",
  "kind": "example",
  "fictional": true,
  "policy": {
    "description": "Fictional invoicing service: permissions apply only within verified current tenant membership. Adapt this example policy before using the template.",
    "memberActions": [
      "list",
      "read"
    ],
    "adminActions": [
      "list",
      "read",
      "create",
      "update",
      "delete",
      "export"
    ],
    "revocation": "next-request",
    "denialStatus": {
      "unauthenticated": 401,
      "forbidden": 403,
      "objectNotVisible": 404
    }
  },
  "fixtureInstructions": [
    "All identities, invoices and expected outcomes are fictional. No requests have been executed.",
    "Reset synthetic seed data before each case. Mutations and membership revocation must not affect subsequent cases.",
    "Create credentials in your own test environment; substitute placeholders only in your private copy.",
    "Capture observed HTTP status, payload assertions and independently checked state before recording a pass."
  ],
  "fixtures": {
    "tenants": {
      "alpha": {
        "id": "0fc2d98c-c9f5-47c1-8477-835e912a9a17"
      },
      "beta": {
        "id": "c3f3d6ef-02ab-4e46-aeaa-33bfed11e011"
      }
    },
    "actors": {
      "alphaAdmin": {
        "tenantKey": "alpha",
        "role": "admin",
        "membership": "active",
        "credentialRef": "${ALPHA_ADMIN_TOKEN}"
      },
      "alphaMember": {
        "tenantKey": "alpha",
        "role": "member",
        "membership": "active",
        "credentialRef": "${ALPHA_MEMBER_TOKEN}"
      },
      "betaAdmin": {
        "tenantKey": "beta",
        "role": "admin",
        "membership": "active",
        "credentialRef": "${BETA_ADMIN_TOKEN}"
      },
      "betaMember": {
        "tenantKey": "beta",
        "role": "member",
        "membership": "active",
        "credentialRef": "${BETA_MEMBER_TOKEN}"
      },
      "anonymous": {
        "tenantKey": null,
        "role": "anonymous",
        "membership": "none",
        "credentialRef": null
      },
      "revokedAlphaMember": {
        "tenantKey": "alpha",
        "role": "member",
        "membership": "revoked",
        "credentialRef": "${ALPHA_MEMBER_TOKEN}"
      }
    },
    "resources": {
      "alphaInvoice": {
        "id": "46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "tenantKey": "alpha",
        "kind": "invoice",
        "invoiceNumber": "ALPHA-001"
      },
      "betaInvoice": {
        "id": "6985a5ca-278f-4e94-9cb1-ef4cda6ac204",
        "tenantKey": "beta",
        "kind": "invoice",
        "invoiceNumber": "BETA-ONLY-001"
      },
      "disposableAlphaInvoice": {
        "id": "87a2b391-c60d-4021-b5a9-e12ce2cd530b",
        "tenantKey": "alpha",
        "kind": "invoice",
        "invoiceNumber": "ALPHA-DELETE-001"
      },
      "alphaExport": {
        "id": "d65a7e91-b8a4-4d36-8e33-83549d7a76ab",
        "tenantKey": "alpha",
        "kind": "export",
        "state": "completed",
        "invoiceKeys": [
          "alphaInvoice",
          "disposableAlphaInvoice"
        ]
      }
    }
  },
  "threatIds": [
    "TM-001",
    "TM-002",
    "TM-003",
    "TM-004",
    "TM-005"
  ],
  "cases": [
    {
      "id": "AUTHZ-001",
      "threatId": "TM-001",
      "purpose": "Member can read any invoice in their own tenant.",
      "actorKey": "alphaMember",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${ALPHA_MEMBER_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Response is the seeded Alpha invoice, with the expected ID and verified Alpha tenant ID."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-002",
      "threatId": "TM-001",
      "purpose": "Admin retains ordinary read permission.",
      "actorKey": "alphaAdmin",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Response is the seeded Alpha invoice, with the expected ID and verified Alpha tenant ID."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-003",
      "threatId": "TM-001",
      "purpose": "An Alpha invoice ID is not visible inside the authorized Beta context.",
      "actorKey": "betaMember",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${BETA_MEMBER_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 404,
        "responseAssertions": [
          "Generic not-found response; no Alpha invoice content, IDs, invoice number, amount, or tenant metadata is returned."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-004",
      "threatId": "TM-001",
      "purpose": "An Alpha invoice ID is not visible inside the authorized Beta context.",
      "actorKey": "betaAdmin",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${BETA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 404,
        "responseAssertions": [
          "Generic not-found response; no Alpha invoice content, IDs, invoice number, amount, or tenant metadata is returned."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-005",
      "threatId": "TM-001",
      "purpose": "Member list is scoped to Alpha.",
      "actorKey": "alphaMember",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices",
        "headers": {
          "Authorization": "Bearer ${ALPHA_MEMBER_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Return exactly the seeded alphaInvoice, disposableAlphaInvoice rows (2 total); an empty result fails.",
          "Every item belongs to Alpha; no Beta IDs, invoice numbers, amounts, counts, or aggregates appear."
        ],
        "sideEffectAssertions": [],
        "payload": {
          "requiredResourceKeys": [
            "alphaInvoice",
            "disposableAlphaInvoice"
          ],
          "exactItemCount": 2,
          "excludedTenantKeys": [
            "beta"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-006",
      "threatId": "TM-001",
      "purpose": "Search must not reveal a Beta-only invoice.",
      "actorKey": "alphaAdmin",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices?search=BETA-ONLY-001",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Empty items and zero matching count; no Beta identifiers, invoice fields, or aggregates appear."
        ],
        "sideEffectAssertions": [],
        "payload": {
          "requiredResourceKeys": [],
          "exactItemCount": 0,
          "excludedTenantKeys": [
            "beta"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-007",
      "threatId": "TM-001",
      "purpose": "Member list is scoped to Beta.",
      "actorKey": "betaMember",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/invoices",
        "headers": {
          "Authorization": "Bearer ${BETA_MEMBER_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Return exactly the seeded betaInvoice rows (1 total); an empty result fails.",
          "Every item belongs to Beta; no Alpha IDs, invoice numbers, amounts, counts, or aggregates appear."
        ],
        "sideEffectAssertions": [],
        "payload": {
          "requiredResourceKeys": [
            "betaInvoice"
          ],
          "exactItemCount": 1,
          "excludedTenantKeys": [
            "alpha"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-008",
      "threatId": "TM-005",
      "purpose": "Member cannot create invoices.",
      "actorKey": "alphaMember",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "POST",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices",
        "headers": {
          "Authorization": "Bearer ${ALPHA_MEMBER_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "invoiceNumber": "SYNTHETIC-NEW-001",
          "amount": 100,
          "currency": "USD"
        }
      },
      "expected": {
        "status": 403,
        "responseAssertions": [
          "Generic forbidden response with no invoice details."
        ],
        "sideEffectAssertions": [
          "No invoice is created in either tenant; inspect state using an independently authorized admin."
        ],
        "state": {
          "unchangedResourceKeys": [
            "alphaInvoice",
            "betaInvoice",
            "disposableAlphaInvoice"
          ],
          "forbiddenEffects": [
            "invoice-created",
            "export-job-queued",
            "export-file-created"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-009",
      "threatId": "TM-005",
      "purpose": "Admin can create an invoice within Alpha.",
      "actorKey": "alphaAdmin",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "POST",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "invoiceNumber": "SYNTHETIC-NEW-001",
          "amount": 100,
          "currency": "USD"
        }
      },
      "expected": {
        "status": 201,
        "responseAssertions": [
          "Created invoice has the submitted fields and the verified Alpha tenant ID."
        ],
        "sideEffectAssertions": [
          "Exactly one invoice is created in Alpha and none in Beta."
        ]
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-010",
      "threatId": "TM-005",
      "purpose": "Admin can update an Alpha invoice.",
      "actorKey": "alphaAdmin",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "PATCH",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "amount": 125
        }
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Updated Alpha invoice is returned."
        ],
        "sideEffectAssertions": [
          "Only the intended Alpha invoice changes; Beta data remains unchanged."
        ]
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-011",
      "threatId": "TM-005",
      "purpose": "Member cannot update an invoice.",
      "actorKey": "alphaMember",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "PATCH",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${ALPHA_MEMBER_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "amount": 125
        }
      },
      "expected": {
        "status": 403,
        "responseAssertions": [
          "Generic forbidden response."
        ],
        "sideEffectAssertions": [
          "Alpha invoice amount and version are unchanged; no update job or event is emitted."
        ],
        "state": {
          "unchangedResourceKeys": [
            "alphaInvoice",
            "betaInvoice",
            "disposableAlphaInvoice"
          ],
          "forbiddenEffects": [
            "invoice-updated",
            "mutation-job-queued"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-012",
      "threatId": "TM-005",
      "purpose": "Admin can delete the disposable Alpha invoice.",
      "actorKey": "alphaAdmin",
      "resourceKey": "disposableAlphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "DELETE",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/87a2b391-c60d-4021-b5a9-e12ce2cd530b",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 204,
        "responseAssertions": [],
        "sideEffectAssertions": [
          "Only the disposable Alpha invoice is deleted; confirm using an authorized Alpha admin read."
        ]
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-013",
      "threatId": "TM-001",
      "purpose": "Beta admin cannot change an Alpha invoice.",
      "actorKey": "betaAdmin",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "PATCH",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${BETA_ADMIN_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "amount": 125
        }
      },
      "expected": {
        "status": 404,
        "responseAssertions": [
          "Generic not-found response without Alpha metadata."
        ],
        "sideEffectAssertions": [
          "No Alpha or Beta record changes and no mutation job or event is emitted; inspect through an authorized Alpha admin."
        ],
        "state": {
          "unchangedResourceKeys": [
            "alphaInvoice",
            "betaInvoice",
            "disposableAlphaInvoice"
          ],
          "forbiddenEffects": [
            "invoice-updated",
            "mutation-job-queued"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-014",
      "threatId": "TM-001",
      "purpose": "Beta admin cannot change an Alpha invoice.",
      "actorKey": "betaAdmin",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "DELETE",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${BETA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 404,
        "responseAssertions": [
          "Generic not-found response without Alpha metadata."
        ],
        "sideEffectAssertions": [
          "No Alpha or Beta record changes and no mutation job or event is emitted; inspect through an authorized Alpha admin."
        ],
        "state": {
          "unchangedResourceKeys": [
            "alphaInvoice",
            "betaInvoice",
            "disposableAlphaInvoice"
          ],
          "forbiddenEffects": [
            "invoice-deleted",
            "mutation-job-queued"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-015",
      "threatId": "TM-002",
      "purpose": "Selecting Beta in the URL does not grant an Alpha admin membership.",
      "actorKey": "alphaAdmin",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/invoices",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 403,
        "responseAssertions": [
          "Generic forbidden response; no Beta data, totals, or tenant metadata appears."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-016",
      "threatId": "TM-005",
      "purpose": "Missing authentication cannot read an invoice.",
      "actorKey": "anonymous",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {},
        "body": null
      },
      "expected": {
        "status": 401,
        "responseAssertions": [
          "Authentication-required response; no invoice or tenant data appears."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-017",
      "threatId": "TM-004",
      "purpose": "Prior credential does not preserve revoked membership.",
      "actorKey": "revokedAlphaMember",
      "resourceKey": "alphaInvoice",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case.",
        "Revoke the Alpha member after issuing ALPHA_MEMBER_TOKEN; reuse that same credential. Restore membership only after the case is complete."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/invoices/46fdb9d8-302e-42b1-b64a-f268f3201a02",
        "headers": {
          "Authorization": "Bearer ${ALPHA_MEMBER_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 403,
        "responseAssertions": [
          "Generic forbidden response without invoice content."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-018",
      "threatId": "TM-003",
      "purpose": "Admin may queue an Alpha export.",
      "actorKey": "alphaAdmin",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "POST",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/exports",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "format": "json"
        }
      },
      "expected": {
        "status": 202,
        "responseAssertions": [
          "Accepted job reference is bound to Alpha; no Beta data appears."
        ],
        "sideEffectAssertions": [
          "Exactly one Alpha export job is queued; verify the worker receives verified Alpha context."
        ]
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-019",
      "threatId": "TM-003",
      "purpose": "Member cannot create export jobs.",
      "actorKey": "alphaMember",
      "resourceKey": null,
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "POST",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/exports",
        "headers": {
          "Authorization": "Bearer ${ALPHA_MEMBER_TOKEN}",
          "Content-Type": "application/json"
        },
        "body": {
          "format": "json"
        }
      },
      "expected": {
        "status": 403,
        "responseAssertions": [
          "Generic forbidden response."
        ],
        "sideEffectAssertions": [
          "No export job is queued and no export file or notification is created in either tenant."
        ],
        "state": {
          "unchangedResourceKeys": [
            "alphaInvoice",
            "betaInvoice",
            "disposableAlphaInvoice"
          ],
          "forbiddenEffects": [
            "export-job-queued",
            "export-file-created",
            "export-notification-created"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-020",
      "threatId": "TM-003",
      "purpose": "Export retrieval must check ownership as well as creation.",
      "actorKey": "betaAdmin",
      "resourceKey": "alphaExport",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/c3f3d6ef-02ab-4e46-aeaa-33bfed11e011/exports/d65a7e91-b8a4-4d36-8e33-83549d7a76ab",
        "headers": {
          "Authorization": "Bearer ${BETA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 404,
        "responseAssertions": [
          "Generic not-found response; no Alpha export bytes, metadata, or signed download URL appears."
        ],
        "sideEffectAssertions": []
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    },
    {
      "id": "AUTHZ-021",
      "threatId": "TM-003",
      "purpose": "Completed Alpha export contains Alpha data only.",
      "actorKey": "alphaAdmin",
      "resourceKey": "alphaExport",
      "preconditions": [
        "Use only an authorized local or test environment. Reset the synthetic fixtures and active memberships before this case.",
        "Seed a completed Alpha export before this case. Do not assume a job from another case has already completed.",
        "Seed the completed export with exactly alphaInvoice and disposableAlphaInvoice, two Alpha rows; reset deletion cases before seeding. Match these invoice IDs in the downloaded rows."
      ],
      "request": {
        "method": "GET",
        "path": "/api/tenants/0fc2d98c-c9f5-47c1-8477-835e912a9a17/exports/d65a7e91-b8a4-4d36-8e33-83549d7a76ab",
        "headers": {
          "Authorization": "Bearer ${ALPHA_ADMIN_TOKEN}"
        },
        "body": null
      },
      "expected": {
        "status": 200,
        "responseAssertions": [
          "Return exactly the seeded alphaInvoice, disposableAlphaInvoice rows (2 total); an empty result fails.",
          "Completed export contains only seeded Alpha rows; no Beta records, identifiers, totals, or metadata appears."
        ],
        "sideEffectAssertions": [],
        "payload": {
          "requiredResourceKeys": [
            "alphaInvoice",
            "disposableAlphaInvoice"
          ],
          "exactItemCount": 2,
          "excludedTenantKeys": [
            "beta"
          ]
        }
      },
      "execution": {
        "status": "not-run",
        "observed": null,
        "evidenceRefs": []
      }
    }
  ]
}