{
  "read": {
    "tool": {
      "label": "Read finance documents",
      "user_request": "Show me the finance workspace documents.",
      "method": "GET",
      "endpoint": "/api/spaces/finance/documents",
      "required_permission": "space.read",
      "impact": "low",
      "approval_required": false,
      "description": "Read protected finance workspace documents."
    },
    "request": {
      "userRequest": "Show me the finance workspace documents.",
      "method": "GET",
      "endpoint": "/api/spaces/finance/documents",
      "body": null
    },
    "required": {
      "vcPermission": "space.read",
      "impact": "low",
      "humanApproval": false,
      "localToolPermission": "tool:read_finance_documents",
      "localNetworkPermission": "network:finance-workspace-api"
    },
    "localDelegation": {
      "personLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "agentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document"
      ],
      "subagentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents"
      ],
      "note": "Local grants are not VCs. They are client-side fine-grained harness permissions and must also be subsets across delegation."
    },
    "chainDetails": [
      {
        "label": "Person A / root user",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "tokenHash": "038bc891075ee789",
        "derivedFrom": [],
        "delegatedBy": null,
        "task": null,
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance",
          "research"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "Agent 1",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjlBZzhNUmdKeG9lV2NteXk0VTlqOUdfYTduenB4N2wxZGxiTWRsSVF6d3cifQ",
        "tokenHash": "b73fca19a7d6afdd",
        "derivedFrom": [
          "038bc891075ee7898c8d125793eaacf3a6571547e0f18136a5e0de835d8fa0ea"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "task": "finance-workspace-document-review",
        "vcPermissions": [
          "space.read",
          "space.write"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document"
        ]
      },
      {
        "label": "CURRENT LEAF SUBAGENT",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjlBZzhNUmdKeG9lV2NteXk0VTlqOUdfYTduenB4N2wxZGxiTWRsSVF6d3cifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6Ilc3ZWtuandYMy1jVWwtNTlrUkxjOVFNY0RrWnlLWVpKbGJfWlRZdEViMm8ifQ",
        "tokenHash": "c9ab9dc10b7a9870",
        "derivedFrom": [
          "b73fca19a7d6afddd5cfcdcef9cbd8833258e6146089b88809cbd70f33f217d7"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjlBZzhNUmdKeG9lV2NteXk0VTlqOUdfYTduenB4N2wxZGxiTWRsSVF6d3cifQ",
        "task": "read-finance-documents-only",
        "vcPermissions": [
          "space.read"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents"
        ]
      }
    ],
    "localDecision": {
      "decision": "allow",
      "where": "Client harness local PDP",
      "reason": "Local fine-grained grants, VC-derived permissions, and approval context satisfy harness policy"
    },
    "executionContext": {
      "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6Ilc3ZWtuandYMy1jVWwtNTlrUkxjOVFNY0RrWnlLWVpKbGJfWlRZdEViMm8ifQ",
      "permissions": [
        "space.read"
      ],
      "spaces": [
        "finance"
      ],
      "credentialTypes": [
        "PersonPermissionCredential",
        "AgentDelegationCredential",
        "SubagentDelegationCredential"
      ],
      "chainLength": 3
    },
    "serverResponse": {
      "status": 200,
      "ok": true,
      "body": {
        "auth": {
          "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
          "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6Ilc3ZWtuandYMy1jVWwtNTlrUkxjOVFNY0RrWnlLWVpKbGJfWlRZdEViMm8ifQ",
          "permissions": [
            "space.read"
          ],
          "spaces": [
            "finance"
          ],
          "credentialTypes": [
            "PersonPermissionCredential",
            "AgentDelegationCredential",
            "SubagentDelegationCredential"
          ],
          "chainLength": 3
        },
        "documents": [
          {
            "id": "fin-1",
            "title": "Q3 Treasury Policy",
            "content": "Treasury policy placeholder."
          },
          {
            "id": "fin-1783088311012",
            "title": "test",
            "content": "Why did the finance memo bring a calculator to the meeting? Because it wanted to count on everyone for a balanced decision."
          },
          {
            "id": "fin-1783088430234",
            "title": "test",
            "content": "Why did the finance memo bring a calculator to the meeting? Because it wanted to count on everyone for a balanced decision."
          }
        ]
      }
    },
    "blockedAt": null,
    "blockedBecause": null
  },
  "writeNeedsApproval": {
    "tool": {
      "label": "Create finance document",
      "user_request": "Create a new finance memo in the finance workspace.",
      "method": "POST",
      "endpoint": "/api/spaces/finance/documents",
      "required_permission": "space.write",
      "impact": "low",
      "approval_required": false,
      "body": {
        "title": "Agent-generated finance memo",
        "content": "Generated by the agent through the Permission Harness Client. No human approval required for document generation."
      },
      "description": "Generate a new finance document. Low impact in this demo; no human approval required."
    },
    "request": {
      "userRequest": "Create a new finance memo in the finance workspace.",
      "method": "POST",
      "endpoint": "/api/spaces/finance/documents",
      "body": {
        "title": "Agent-generated finance memo",
        "content": "Generated by the agent through the Permission Harness Client. No human approval required for document generation."
      }
    },
    "required": {
      "vcPermission": "space.write",
      "impact": "low",
      "humanApproval": false,
      "localToolPermission": "tool:create_finance_document",
      "localNetworkPermission": "network:finance-workspace-api"
    },
    "localDelegation": {
      "personLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "agentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "subagentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document"
      ],
      "note": "Local grants are not VCs. They are client-side fine-grained harness permissions and must also be subsets across delegation."
    },
    "chainDetails": [
      {
        "label": "Person A / root user",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "tokenHash": "038bc891075ee789",
        "derivedFrom": [],
        "delegatedBy": null,
        "task": null,
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance",
          "research"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "Agent 1",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImpUclppRDFvaG9iNEQzSWVlYWZxLWlNUjRzOHJ1aWFZZk1XcWVHb0N4akkifQ",
        "tokenHash": "bcc7b956774ed756",
        "derivedFrom": [
          "038bc891075ee7898c8d125793eaacf3a6571547e0f18136a5e0de835d8fa0ea"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "task": "finance-workspace-operations",
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "CURRENT LEAF SUBAGENT",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImpUclppRDFvaG9iNEQzSWVlYWZxLWlNUjRzOHJ1aWFZZk1XcWVHb0N4akkifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImtrTERSdEstV3ZkTFljUTIxWHFtX1FYTUdyZER0QXdUMnFaSDJvQWtJdU0ifQ",
        "tokenHash": "9d5aab35e3e634f1",
        "derivedFrom": [
          "bcc7b956774ed756e43a355afb56599ac48719153286f2d9805042409a0d03ee"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImpUclppRDFvaG9iNEQzSWVlYWZxLWlNUjRzOHJ1aWFZZk1XcWVHb0N4akkifQ",
        "task": "approved-finance-document-writer",
        "vcPermissions": [
          "space.read",
          "space.write"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document"
        ]
      }
    ],
    "localDecision": {
      "decision": "allow",
      "where": "Client harness local PDP",
      "reason": "Local fine-grained grants, VC-derived permissions, and approval context satisfy harness policy"
    },
    "executionContext": {
      "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImtrTERSdEstV3ZkTFljUTIxWHFtX1FYTUdyZER0QXdUMnFaSDJvQWtJdU0ifQ",
      "permissions": [
        "space.read",
        "space.write"
      ],
      "spaces": [
        "finance"
      ],
      "credentialTypes": [
        "PersonPermissionCredential",
        "AgentDelegationCredential",
        "SubagentDelegationCredential"
      ],
      "chainLength": 3
    },
    "serverResponse": {
      "status": 201,
      "ok": true,
      "body": {
        "auth": {
          "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
          "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImtrTERSdEstV3ZkTFljUTIxWHFtX1FYTUdyZER0QXdUMnFaSDJvQWtJdU0ifQ",
          "permissions": [
            "space.read",
            "space.write"
          ],
          "spaces": [
            "finance"
          ],
          "credentialTypes": [
            "PersonPermissionCredential",
            "AgentDelegationCredential",
            "SubagentDelegationCredential"
          ],
          "chainLength": 3
        },
        "created": {
          "id": "fin-1783089002904",
          "title": "Agent-generated finance memo",
          "content": "Generated by the agent through the Permission Harness Client. No human approval required for document generation."
        }
      }
    },
    "blockedAt": null,
    "blockedBecause": null
  },
  "writeApproved": {
    "tool": {
      "label": "Create finance document",
      "user_request": "Create a new finance memo in the finance workspace.",
      "method": "POST",
      "endpoint": "/api/spaces/finance/documents",
      "required_permission": "space.write",
      "impact": "low",
      "approval_required": false,
      "body": {
        "title": "Agent-generated finance memo",
        "content": "Generated by the agent through the Permission Harness Client. No human approval required for document generation."
      },
      "description": "Generate a new finance document. Low impact in this demo; no human approval required."
    },
    "request": {
      "userRequest": "Create a new finance memo in the finance workspace.",
      "method": "POST",
      "endpoint": "/api/spaces/finance/documents",
      "body": {
        "title": "Agent-generated finance memo",
        "content": "Generated by the agent through the Permission Harness Client. No human approval required for document generation."
      }
    },
    "required": {
      "vcPermission": "space.write",
      "impact": "low",
      "humanApproval": false,
      "localToolPermission": "tool:create_finance_document",
      "localNetworkPermission": "network:finance-workspace-api"
    },
    "localDelegation": {
      "personLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "agentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "subagentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document"
      ],
      "note": "Local grants are not VCs. They are client-side fine-grained harness permissions and must also be subsets across delegation."
    },
    "chainDetails": [
      {
        "label": "Person A / root user",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "tokenHash": "038bc891075ee789",
        "derivedFrom": [],
        "delegatedBy": null,
        "task": null,
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance",
          "research"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "Agent 1",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImJJVktPeDNPTTdMMWd6aG96Z3BmUjJ0UURObWgtTmNUQzh1N2tkZ2dLSjgifQ",
        "tokenHash": "9f48d67f36630ef4",
        "derivedFrom": [
          "038bc891075ee7898c8d125793eaacf3a6571547e0f18136a5e0de835d8fa0ea"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "task": "finance-workspace-operations",
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "CURRENT LEAF SUBAGENT",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImJJVktPeDNPTTdMMWd6aG96Z3BmUjJ0UURObWgtTmNUQzh1N2tkZ2dLSjgifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjZPWlpSbWI4ZFY4NFNvY1pjUTBOb3hnQTB4SnFYNkVYVVRnN3I5WmpDUDQifQ",
        "tokenHash": "259291d4bbef206c",
        "derivedFrom": [
          "9f48d67f36630ef432de9e48e844a70959c1fddaad1e19e0a2edd6ea2c136967"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImJJVktPeDNPTTdMMWd6aG96Z3BmUjJ0UURObWgtTmNUQzh1N2tkZ2dLSjgifQ",
        "task": "approved-finance-document-writer",
        "vcPermissions": [
          "space.read",
          "space.write"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document"
        ]
      }
    ],
    "localDecision": {
      "decision": "allow",
      "where": "Client harness local PDP",
      "reason": "Local fine-grained grants, VC-derived permissions, and approval context satisfy harness policy"
    },
    "executionContext": {
      "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjZPWlpSbWI4ZFY4NFNvY1pjUTBOb3hnQTB4SnFYNkVYVVRnN3I5WmpDUDQifQ",
      "permissions": [
        "space.read",
        "space.write"
      ],
      "spaces": [
        "finance"
      ],
      "credentialTypes": [
        "PersonPermissionCredential",
        "AgentDelegationCredential",
        "SubagentDelegationCredential"
      ],
      "chainLength": 3
    },
    "serverResponse": {
      "status": 201,
      "ok": true,
      "body": {
        "auth": {
          "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
          "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IjZPWlpSbWI4ZFY4NFNvY1pjUTBOb3hnQTB4SnFYNkVYVVRnN3I5WmpDUDQifQ",
          "permissions": [
            "space.read",
            "space.write"
          ],
          "spaces": [
            "finance"
          ],
          "credentialTypes": [
            "PersonPermissionCredential",
            "AgentDelegationCredential",
            "SubagentDelegationCredential"
          ],
          "chainLength": 3
        },
        "created": {
          "id": "fin-1783089002913",
          "title": "Agent-generated finance memo",
          "content": "Generated by the agent through the Permission Harness Client. No human approval required for document generation."
        }
      }
    },
    "blockedAt": null,
    "blockedBecause": null
  },
  "paymentDeniedLocally": {
    "tool": {
      "label": "Execute payment",
      "user_request": "Pay CHF 100 to Example Vendor.",
      "method": "POST",
      "endpoint": "/api/payments",
      "required_permission": "payment.execute",
      "impact": "high",
      "approval_required": true,
      "body": {
        "amount": 100,
        "currency": "CHF",
        "recipient": "Example Vendor"
      },
      "description": "Simulate payment execution. High impact; requires approval and permission."
    },
    "request": {
      "userRequest": "Pay CHF 100 to Example Vendor.",
      "method": "POST",
      "endpoint": "/api/payments",
      "body": {
        "amount": 100,
        "currency": "CHF",
        "recipient": "Example Vendor"
      }
    },
    "required": {
      "vcPermission": "payment.execute",
      "impact": "high",
      "humanApproval": true,
      "localToolPermission": "tool:execute_payment",
      "localNetworkPermission": "network:finance-workspace-api"
    },
    "localDelegation": {
      "personLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "agentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "subagentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document"
      ],
      "note": "Local grants are not VCs. They are client-side fine-grained harness permissions and must also be subsets across delegation."
    },
    "chainDetails": [
      {
        "label": "Person A / root user",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "tokenHash": "038bc891075ee789",
        "derivedFrom": [],
        "delegatedBy": null,
        "task": null,
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance",
          "research"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "Agent 1",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkVkc2dWVUt4d2JQZDhXZDB0YmxnWVE2WmoyQTVkSnNrOUxoeDAwN205OTAifQ",
        "tokenHash": "4f4fadbe17728404",
        "derivedFrom": [
          "038bc891075ee7898c8d125793eaacf3a6571547e0f18136a5e0de835d8fa0ea"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "task": "finance-workspace-operations",
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "CURRENT LEAF SUBAGENT",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkVkc2dWVUt4d2JQZDhXZDB0YmxnWVE2WmoyQTVkSnNrOUxoeDAwN205OTAifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IlFkX05EOTMzcVhLakpWa21DY19Uc0xkYmFEcFEtOG1iSmVzalFtaVRBUTgifQ",
        "tokenHash": "36d3d6f3a438e73f",
        "derivedFrom": [
          "4f4fadbe17728404d77c248a78e124f9893d3db1a8af7552a68984d36294b3bb"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkVkc2dWVUt4d2JQZDhXZDB0YmxnWVE2WmoyQTVkSnNrOUxoeDAwN205OTAifQ",
        "task": "approved-finance-document-writer",
        "vcPermissions": [
          "space.read",
          "space.write"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document"
        ]
      }
    ],
    "localDecision": {
      "decision": "deny",
      "where": "Client harness local PDP",
      "reason": "Missing local tool permission tool:execute_payment"
    },
    "skippedServerCall": true,
    "executionContext": {
      "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IlFkX05EOTMzcVhLakpWa21DY19Uc0xkYmFEcFEtOG1iSmVzalFtaVRBUTgifQ",
      "permissions": [
        "space.read",
        "space.write"
      ],
      "spaces": [
        "finance"
      ],
      "credentialTypes": [
        "PersonPermissionCredential",
        "AgentDelegationCredential",
        "SubagentDelegationCredential"
      ],
      "chainLength": 3
    },
    "blockedAt": "Client harness local PDP",
    "blockedBecause": "Missing local tool permission tool:execute_payment"
  },
  "paymentBlockedServerSide": {
    "tool": {
      "label": "Execute payment",
      "user_request": "Pay CHF 100 to Example Vendor.",
      "method": "POST",
      "endpoint": "/api/payments",
      "required_permission": "payment.execute",
      "impact": "high",
      "approval_required": true,
      "body": {
        "amount": 100,
        "currency": "CHF",
        "recipient": "Example Vendor"
      },
      "description": "Simulate payment execution. High impact; requires approval and permission."
    },
    "request": {
      "userRequest": "Pay CHF 100 to Example Vendor.",
      "method": "POST",
      "endpoint": "/api/payments",
      "body": {
        "amount": 100,
        "currency": "CHF",
        "recipient": "Example Vendor"
      }
    },
    "required": {
      "vcPermission": "payment.execute",
      "impact": "high",
      "humanApproval": true,
      "localToolPermission": "tool:execute_payment",
      "localNetworkPermission": "network:finance-workspace-api"
    },
    "localDelegation": {
      "personLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "agentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ],
      "subagentLocalGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document"
      ],
      "note": "Local grants are not VCs. They are client-side fine-grained harness permissions and must also be subsets across delegation."
    },
    "chainDetails": [
      {
        "label": "Person A / root user",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "tokenHash": "038bc891075ee789",
        "derivedFrom": [],
        "delegatedBy": null,
        "task": null,
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance",
          "research"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "Agent 1",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkgxcEVXVE5Dci1mRHg0anEtb1pHYmFSdDFBbjkwNjdIZ2JpUFhxWXpYTFkifQ",
        "tokenHash": "3be021b6b41b41cd",
        "derivedFrom": [
          "038bc891075ee7898c8d125793eaacf3a6571547e0f18136a5e0de835d8fa0ea"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImVsU1dwUkFPSnRQcDFIanM1aGdBUFl2RERUV0s2b2xwcW55RjBjaW1rdWMifQ",
        "task": "finance-workspace-operations",
        "vcPermissions": [
          "space.read",
          "space.write",
          "space.delete",
          "payment.execute"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document",
          "tool:delete_finance_document",
          "tool:execute_payment"
        ]
      },
      {
        "label": "CURRENT LEAF SUBAGENT",
        "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkgxcEVXVE5Dci1mRHg0anEtb1pHYmFSdDFBbjkwNjdIZ2JpUFhxWXpYTFkifQ",
        "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6InVEeEdXU2lza1F0Yk84TWJyb2pIaU03U0JMOEtoR2I3WHhMcllDVjJRUXMifQ",
        "tokenHash": "64330de62d452acd",
        "derivedFrom": [
          "3be021b6b41b41cdc0357627a780fb8faf32f692a4312a180585e062700183d4"
        ],
        "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkgxcEVXVE5Dci1mRHg0anEtb1pHYmFSdDFBbjkwNjdIZ2JpUFhxWXpYTFkifQ",
        "task": "approved-finance-document-writer",
        "vcPermissions": [
          "space.read",
          "space.write"
        ],
        "spaces": [
          "finance"
        ],
        "localGrants": [
          "network:finance-workspace-api",
          "tool:read_finance_documents",
          "tool:create_finance_document"
        ]
      }
    ],
    "localDecision": {
      "decision": "deny",
      "where": "Client harness local PDP",
      "reason": "Missing local tool permission tool:execute_payment",
      "bypassedForServerProof": true
    },
    "executionContext": {
      "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IkRCRWZuTl9MR1V5bTNBVlFVUVN1NDBYWVNUMzJJWDFvUFFKQk1DMFc5aGcifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6InVEeEdXU2lza1F0Yk84TWJyb2pIaU03U0JMOEtoR2I3WHhMcllDVjJRUXMifQ",
      "permissions": [
        "space.read",
        "space.write"
      ],
      "spaces": [
        "finance"
      ],
      "credentialTypes": [
        "PersonPermissionCredential",
        "AgentDelegationCredential",
        "SubagentDelegationCredential"
      ],
      "chainLength": 3
    },
    "serverResponse": {
      "status": 403,
      "ok": false,
      "body": {
        "error": "Missing permission payment.execute"
      }
    },
    "blockedAt": "Finance Workspace API server-side verifier",
    "blockedBecause": "Missing permission payment.execute"
  }
}