{
  "tool": {
    "label": "Execute payment",
    "user_request": "Pay CHF 100 to Example Vendor.",
    "method": "POST",
    "endpoint": "/api/payments",
    "required_permission": "payment.execute",
    "impact": "high",
    "approval_required": true,
    "body": {
      "amount": 100,
      "currency": "CHF",
      "recipient": "Example Vendor"
    },
    "description": "Simulate payment execution. High impact; requires approval and permission."
  },
  "request": {
    "userRequest": "Pay CHF 100 to Example Vendor.",
    "method": "POST",
    "endpoint": "/api/payments",
    "body": {
      "amount": 100,
      "currency": "CHF",
      "recipient": "Example Vendor"
    }
  },
  "required": {
    "vcPermission": "payment.execute",
    "impact": "high",
    "humanApproval": true,
    "localToolPermission": "tool:execute_payment",
    "localNetworkPermission": "network:finance-workspace-api"
  },
  "localDelegation": {
    "personLocalGrants": [
      "network:finance-workspace-api",
      "tool:read_finance_documents",
      "tool:create_finance_document",
      "tool:delete_finance_document",
      "tool:execute_payment"
    ],
    "agentLocalGrants": [
      "network:finance-workspace-api",
      "tool:read_finance_documents",
      "tool:create_finance_document",
      "tool:delete_finance_document",
      "tool:execute_payment"
    ],
    "subagentLocalGrants": [
      "network:finance-workspace-api",
      "tool:read_finance_documents",
      "tool:create_finance_document"
    ],
    "note": "Local grants are not VCs. They are client-side fine-grained harness permissions and must also be subsets across delegation."
  },
  "chainDetails": [
    {
      "label": "Person A / root user",
      "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6Ik56Zm9nVVZYU3BzOW1YcDdtY1RXWl9jS01GTzhNU2lScHZZQ0NPcllReEEifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IldOMkFtOEdUQ2Rpelo4N200VHVmSTRaQVpVaFotNlhNMVRnay1xbTBnVE0ifQ",
      "tokenHash": "7bb0d07ae9897585",
      "derivedFrom": [],
      "delegatedBy": null,
      "task": null,
      "vcPermissions": [
        "space.read",
        "space.write",
        "space.delete",
        "payment.execute"
      ],
      "spaces": [
        "finance",
        "research"
      ],
      "localGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ]
    },
    {
      "label": "Agent 1",
      "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IldOMkFtOEdUQ2Rpelo4N200VHVmSTRaQVpVaFotNlhNMVRnay1xbTBnVE0ifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImRST0c4OTJ5c2h0NjcyOHZVOEgybjFSY1daWVFaMTJDZUh2aTVSSTBseUUifQ",
      "tokenHash": "66baf36724bfdf32",
      "derivedFrom": [
        "7bb0d07ae98975858795f6149cf9ffbf5d1e992c12e4cb7d976495719e41b9a2"
      ],
      "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IldOMkFtOEdUQ2Rpelo4N200VHVmSTRaQVpVaFotNlhNMVRnay1xbTBnVE0ifQ",
      "task": "finance-workspace-operations",
      "vcPermissions": [
        "space.read",
        "space.write",
        "space.delete",
        "payment.execute"
      ],
      "spaces": [
        "finance"
      ],
      "localGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document",
        "tool:delete_finance_document",
        "tool:execute_payment"
      ]
    },
    {
      "label": "CURRENT LEAF SUBAGENT",
      "issuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImRST0c4OTJ5c2h0NjcyOHZVOEgybjFSY1daWVFaMTJDZUh2aTVSSTBseUUifQ",
      "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IlRDTm1FR2dBZDZDajNnV2VzRWFfa2lKLXVMbFVEREUwODBrOExoZld2QTQifQ",
      "tokenHash": "4a3b0a237b39b8c8",
      "derivedFrom": [
        "66baf36724bfdf321de7f0e4872f746bc11319763038e0257c035df350466957"
      ],
      "delegatedBy": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6ImRST0c4OTJ5c2h0NjcyOHZVOEgybjFSY1daWVFaMTJDZUh2aTVSSTBseUUifQ",
      "task": "approved-finance-document-writer",
      "vcPermissions": [
        "space.read",
        "space.write"
      ],
      "spaces": [
        "finance"
      ],
      "localGrants": [
        "network:finance-workspace-api",
        "tool:read_finance_documents",
        "tool:create_finance_document"
      ]
    }
  ],
  "localDecision": {
    "decision": "deny",
    "where": "Client harness local PDP",
    "reason": "Missing local tool permission tool:execute_payment",
    "bypassedForServerProof": true
  },
  "executionContext": {
    "rootIssuer": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6Ik56Zm9nVVZYU3BzOW1YcDdtY1RXWl9jS01GTzhNU2lScHZZQ0NPcllReEEifQ",
    "subject": "did:jwk:eyJjcnYiOiJFZDI1NTE5Iiwia3R5IjoiT0tQIiwieCI6IlRDTm1FR2dBZDZDajNnV2VzRWFfa2lKLXVMbFVEREUwODBrOExoZld2QTQifQ",
    "permissions": [
      "space.read",
      "space.write"
    ],
    "spaces": [
      "finance"
    ],
    "credentialTypes": [
      "PersonPermissionCredential",
      "AgentDelegationCredential",
      "SubagentDelegationCredential"
    ],
    "chainLength": 3
  },
  "serverResponse": {
    "status": 403,
    "ok": false,
    "body": {
      "error": "Missing permission payment.execute"
    }
  },
  "blockedAt": "Finance Workspace API server-side verifier",
  "blockedBecause": "Missing permission payment.execute"
}