{
  "clock_ms": 1800000000000,
  "decisions": [
    {
      "action": "read",
      "agent_id": 1,
      "allowed": true,
      "grant_id": 1,
      "id": 1,
      "reason": "allowed",
      "resource": "evidence",
      "task_id": 1,
      "time_ms": 1800000000001
    },
    {
      "action": "read",
      "agent_id": 1,
      "allowed": false,
      "grant_id": 1,
      "id": 2,
      "reason": "use_budget_exhausted",
      "resource": "evidence",
      "task_id": 1,
      "time_ms": 1800000000002
    }
  ],
  "events": [
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 1,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999950000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 2,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999954000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 3,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999958000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 4,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999962000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 5,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999966000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 6,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999970000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 7,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999974000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 8,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999978000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 9,
      "json_bytes": 168,
      "kind": "authentication",
      "notation": "AU− s3:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "deny",
      "severity": 3,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999982000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 10,
      "json_bytes": 170,
      "kind": "authentication",
      "notation": "AU+ s2:2→3",
      "object": 3,
      "object_label": "control-api",
      "observed_ms": 1800000000000,
      "outcome": "allow",
      "severity": 2,
      "source": 1,
      "source_label": "identity-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999994000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 11,
      "json_bytes": 163,
      "kind": "process",
      "notation": "PX+ s5:2→5",
      "object": 5,
      "object_label": "privileged-worker",
      "observed_ms": 1800000000000,
      "outcome": "allow",
      "severity": 5,
      "source": 4,
      "source_label": "runtime-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1799999997000,
      "trace": 1
    },
    {
      "bytes": 33554432,
      "encoded_bytes": 28,
      "id": 12,
      "json_bytes": 170,
      "kind": "network",
      "notation": "NF+ s5:2→6",
      "object": 6,
      "object_label": "external-sink",
      "observed_ms": 1800000000000,
      "outcome": "allow",
      "severity": 5,
      "source": 4,
      "source_label": "runtime-sensor",
      "subject": 2,
      "subject_label": "operator-0001",
      "time_ms": 1800000000000,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 13,
      "json_bytes": 162,
      "kind": "policy",
      "notation": "PL+ s1:8→9",
      "object": 9,
      "object_label": "evidence",
      "observed_ms": 1800000000001,
      "outcome": "allow",
      "severity": 1,
      "source": 7,
      "source_label": "agent-gateway",
      "subject": 8,
      "subject_label": "agent-1",
      "time_ms": 1800000000001,
      "trace": 1
    },
    {
      "bytes": 0,
      "encoded_bytes": 25,
      "id": 14,
      "json_bytes": 161,
      "kind": "policy",
      "notation": "PL− s4:8→9",
      "object": 9,
      "object_label": "evidence",
      "observed_ms": 1800000000002,
      "outcome": "deny",
      "severity": 4,
      "source": 7,
      "source_label": "agent-gateway",
      "subject": 8,
      "subject_label": "agent-1",
      "time_ms": 1800000000002,
      "trace": 1
    }
  ],
  "findings": [
    {
      "evidence": [
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 14,
          "json_bytes": 161,
          "kind": "policy",
          "notation": "PL− s4:8→9",
          "object": 9,
          "object_label": "evidence",
          "observed_ms": 1800000000002,
          "outcome": "deny",
          "severity": 4,
          "source": 7,
          "source_label": "agent-gateway",
          "subject": 8,
          "subject_label": "agent-1",
          "time_ms": 1800000000002,
          "trace": 1
        }
      ],
      "explanation": "A high-severity policy denial signals a blocked action at the control-plane boundary. Matched 1 retained fact(s) for agent-1. This is a deterministic signal; investigate context before attributing intent.",
      "id": 10,
      "rule": "AX-004",
      "severity": 3,
      "status": "open",
      "subject": "agent-1",
      "time_ms": 1800000000002,
      "title": "Policy boundary denied"
    },
    {
      "evidence": [
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 11,
          "json_bytes": 163,
          "kind": "process",
          "notation": "PX+ s5:2→5",
          "object": 5,
          "object_label": "privileged-worker",
          "observed_ms": 1800000000000,
          "outcome": "allow",
          "severity": 5,
          "source": 4,
          "source_label": "runtime-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999997000,
          "trace": 1
        },
        {
          "bytes": 33554432,
          "encoded_bytes": 28,
          "id": 12,
          "json_bytes": 170,
          "kind": "network",
          "notation": "NF+ s5:2→6",
          "object": 6,
          "object_label": "external-sink",
          "observed_ms": 1800000000000,
          "outcome": "allow",
          "severity": 5,
          "source": 4,
          "source_label": "runtime-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1800000000000,
          "trace": 1
        }
      ],
      "explanation": "At least 10 MiB sent after a high-severity process execution by the same subject inside three minutes. Matched 2 retained fact(s) for operator-0001. This is a deterministic signal; investigate context before attributing intent.",
      "id": 3,
      "rule": "AX-003",
      "severity": 5,
      "status": "open",
      "subject": "operator-0001",
      "time_ms": 1800000000000,
      "title": "Egress after execution"
    },
    {
      "evidence": [
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 10,
          "json_bytes": 170,
          "kind": "authentication",
          "notation": "AU+ s2:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "allow",
          "severity": 2,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999994000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 11,
          "json_bytes": 163,
          "kind": "process",
          "notation": "PX+ s5:2→5",
          "object": 5,
          "object_label": "privileged-worker",
          "observed_ms": 1800000000000,
          "outcome": "allow",
          "severity": 5,
          "source": 4,
          "source_label": "runtime-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999997000,
          "trace": 1
        }
      ],
      "explanation": "A high-severity process execution follows a successful authentication for the same subject inside one minute. Matched 2 retained fact(s) for operator-0001. This is a deterministic signal; investigate context before attributing intent.",
      "id": 2,
      "rule": "AX-002",
      "severity": 5,
      "status": "open",
      "subject": "operator-0001",
      "time_ms": 1799999997000,
      "title": "Privilege sequence"
    },
    {
      "evidence": [
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 1,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999950000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 2,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999954000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 3,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999958000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 4,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999962000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 5,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999966000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 6,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999970000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 7,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999974000,
          "trace": 1
        },
        {
          "bytes": 0,
          "encoded_bytes": 25,
          "id": 8,
          "json_bytes": 168,
          "kind": "authentication",
          "notation": "AU− s3:2→3",
          "object": 3,
          "object_label": "control-api",
          "observed_ms": 1800000000000,
          "outcome": "deny",
          "severity": 3,
          "source": 1,
          "source_label": "identity-sensor",
          "subject": 2,
          "subject_label": "operator-0001",
          "time_ms": 1799999978000,
          "trace": 1
        }
      ],
      "explanation": "Eight denied authentication events for one subject inside two minutes. Matched 8 retained fact(s) for operator-0001. This is a deterministic signal; investigate context before attributing intent.",
      "id": 1,
      "rule": "AX-001",
      "severity": 4,
      "status": "open",
      "subject": "operator-0001",
      "time_ms": 1799999978000,
      "title": "Authentication burst"
    }
  ],
  "limitations": "In-memory fixture. No journald, live agent, privileged response, or production endpoint.",
  "mode": "deterministic Rust replay",
  "received": 12,
  "schema_version": 1,
  "synthetic": true
}