{
  "scope": "Proposed policy with trusted inputs supplied directly. 48 matrix cases plus 5 separate negative inputs. No real identity provider, HTTP route, database filter or penetration test.",
  "rows": [
    {
      "role": "owner",
      "scope": "same tenant",
      "action": "read",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "owner",
      "scope": "same tenant",
      "action": "edit",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "owner",
      "scope": "same tenant",
      "action": "invite",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "owner",
      "scope": "same tenant",
      "action": "export",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "owner",
      "scope": "same tenant",
      "action": "billing",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "owner",
      "scope": "same tenant",
      "action": "delete",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "owner",
      "scope": "other tenant",
      "action": "read",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "owner",
      "scope": "other tenant",
      "action": "edit",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "owner",
      "scope": "other tenant",
      "action": "invite",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "owner",
      "scope": "other tenant",
      "action": "export",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "owner",
      "scope": "other tenant",
      "action": "billing",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "owner",
      "scope": "other tenant",
      "action": "delete",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "editor",
      "scope": "same tenant",
      "action": "read",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "editor",
      "scope": "same tenant",
      "action": "edit",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "editor",
      "scope": "same tenant",
      "action": "invite",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "editor",
      "scope": "same tenant",
      "action": "export",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "editor",
      "scope": "same tenant",
      "action": "billing",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "editor",
      "scope": "same tenant",
      "action": "delete",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "editor",
      "scope": "other tenant",
      "action": "read",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "editor",
      "scope": "other tenant",
      "action": "edit",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "editor",
      "scope": "other tenant",
      "action": "invite",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "editor",
      "scope": "other tenant",
      "action": "export",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "editor",
      "scope": "other tenant",
      "action": "billing",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "editor",
      "scope": "other tenant",
      "action": "delete",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "viewer",
      "scope": "same tenant",
      "action": "read",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "viewer",
      "scope": "same tenant",
      "action": "edit",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "viewer",
      "scope": "same tenant",
      "action": "invite",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "viewer",
      "scope": "same tenant",
      "action": "export",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "viewer",
      "scope": "same tenant",
      "action": "billing",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "viewer",
      "scope": "same tenant",
      "action": "delete",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "viewer",
      "scope": "other tenant",
      "action": "read",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "viewer",
      "scope": "other tenant",
      "action": "edit",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "viewer",
      "scope": "other tenant",
      "action": "invite",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "viewer",
      "scope": "other tenant",
      "action": "export",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "viewer",
      "scope": "other tenant",
      "action": "billing",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "viewer",
      "scope": "other tenant",
      "action": "delete",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "billing",
      "scope": "same tenant",
      "action": "read",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "billing",
      "scope": "same tenant",
      "action": "edit",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "billing",
      "scope": "same tenant",
      "action": "invite",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "billing",
      "scope": "same tenant",
      "action": "export",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "billing",
      "scope": "same tenant",
      "action": "billing",
      "allowed": true,
      "reason": "explicit permission in matching tenant"
    },
    {
      "role": "billing",
      "scope": "same tenant",
      "action": "delete",
      "allowed": false,
      "reason": "permission absent"
    },
    {
      "role": "billing",
      "scope": "other tenant",
      "action": "read",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "billing",
      "scope": "other tenant",
      "action": "edit",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "billing",
      "scope": "other tenant",
      "action": "invite",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "billing",
      "scope": "other tenant",
      "action": "export",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "billing",
      "scope": "other tenant",
      "action": "billing",
      "allowed": false,
      "reason": "tenant mismatch"
    },
    {
      "role": "billing",
      "scope": "other tenant",
      "action": "delete",
      "allowed": false,
      "reason": "tenant mismatch"
    }
  ],
  "summary": [
    {
      "role": "owner",
      "allowed": 6,
      "denied": 6
    },
    {
      "role": "editor",
      "allowed": 2,
      "denied": 10
    },
    {
      "role": "viewer",
      "allowed": 1,
      "denied": 11
    },
    {
      "role": "billing",
      "allowed": 2,
      "denied": 10
    }
  ],
  "edgeCases": [
    {
      "case": "unknown role",
      "allowed": false,
      "reason": "unknown policy input"
    },
    {
      "case": "unknown action",
      "allowed": false,
      "reason": "unknown policy input"
    },
    {
      "case": "unauthenticated",
      "allowed": false,
      "reason": "unauthenticated"
    },
    {
      "case": "missing tenant",
      "allowed": false,
      "reason": "membership or tenant missing"
    },
    {
      "case": "revoked membership",
      "allowed": false,
      "reason": "membership or tenant missing"
    }
  ]
}