@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-authorization-files.js

@@ -0,0 +1,2314 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductAuthorizationFiles = renderProductAuthorizationFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductAuthorizationFiles(name, pascalName) {
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    return {
+        'authorization/policy.ts': `import {
+  defineAuthorizationPolicy,
+  defineCoarseAdmission,
+  type AuthorizationContext,
+  type AuthorizationInput,
+  type AuthorizationResource,
+} from '@empire-builder-kit/runtime/authorization';
+
+export const ${identifierPrefix}AuthorizationActions = {
+  approvalReview: '${name}:approval-review',
+  dataExportCleanup: '${name}:data-export-cleanup',
+  databaseRead: '${name}:database-read',
+  eventPublish: '${name}:event-publish',
+  lifecycleConsume: '${name}:lifecycle-consume',
+  machineProofRead: '${name}:machine-proof-read',
+  protectedRead: '${name}:protected-read',
+  recordDelegationIssue: '${name}:record-delegation-issue',
+  recordDelegationRevoke: '${name}:record-delegation-revoke',
+  recordDelegationUse: '${name}:record-delegation-use',
+  recordDelete: '${name}:record-delete',
+  recordExport: '${name}:record-export',
+  recordExportCleanup: '${name}:record-export-cleanup',
+  recordHoldManage: '${name}:record-hold-manage',
+  recordRead: '${name}:record-read',
+  recordWrite: '${name}:record-write',
+  retentionApply: '${name}:retention-apply',
+  retentionMaintenance: '${name}:retention-maintenance',
+  retentionReport: '${name}:retention-report',
+  retentionReview: '${name}:retention-review',
+} as const;
+
+export type ${pascalName}AuthorizationAction =
+  (typeof ${identifierPrefix}AuthorizationActions)[keyof typeof ${identifierPrefix}AuthorizationActions];
+
+/**
+ * Cognito resource-server scopes are not application action identifiers.
+ * Keep this mapping explicit so adding an action never grants it to the
+ * Standard confidential client implicitly.
+ */
+export function ${identifierPrefix}MachineScopes(stage: string) {
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(stage)) {
+    throw new Error('Machine authorization requires a safe deployed stage.');
+  }
+  const resourceServer = '${name}-' + stage;
+  return {
+    delegationUse: resourceServer + '/delegation-use',
+    proofReader: resourceServer + '/proof-read',
+  } as const;
+}
+
+export function ${identifierPrefix}MachineScopeForAction(
+  action: ${pascalName}AuthorizationAction,
+  stage: string,
+): string | undefined {
+  const scopes = ${identifierPrefix}MachineScopes(stage);
+  switch (action) {
+    case ${identifierPrefix}AuthorizationActions.machineProofRead:
+      return scopes.proofReader;
+    case ${identifierPrefix}AuthorizationActions.recordDelegationUse:
+      return scopes.delegationUse;
+    default:
+      return undefined;
+  }
+}
+
+export interface ${pascalName}ResourceAttributes {
+  collection?: boolean;
+  ownerId?: string;
+  syntheticTestData?: boolean;
+}
+
+export type ${pascalName}AuthorizationResource = AuthorizationResource<
+  'record' | 'slice',
+  Readonly<${pascalName}ResourceAttributes>
+>;
+
+export type ${pascalName}AuthorizationInput = AuthorizationInput<
+  ${pascalName}AuthorizationAction,
+  ${pascalName}AuthorizationResource,
+  AuthorizationContext<Readonly<{ operationId: string }>>
+>;
+
+const recordActions = new Set<${pascalName}AuthorizationAction>([
+  ${identifierPrefix}AuthorizationActions.recordDelegationIssue,
+  ${identifierPrefix}AuthorizationActions.recordDelegationRevoke,
+  ${identifierPrefix}AuthorizationActions.recordDelegationUse,
+  ${identifierPrefix}AuthorizationActions.recordDelete,
+  ${identifierPrefix}AuthorizationActions.recordExport,
+  ${identifierPrefix}AuthorizationActions.recordExportCleanup,
+  ${identifierPrefix}AuthorizationActions.recordHoldManage,
+  ${identifierPrefix}AuthorizationActions.recordRead,
+  ${identifierPrefix}AuthorizationActions.recordWrite,
+]);
+
+export function ${identifierPrefix}InternalWorkloadIdentityForAction(
+  action: ${pascalName}AuthorizationAction,
+): string | undefined {
+  switch (action) {
+    case ${identifierPrefix}AuthorizationActions.lifecycleConsume:
+      return '${name}:event-consumer';
+    case ${identifierPrefix}AuthorizationActions.dataExportCleanup:
+      return '${name}:data-export-cleanup';
+    case ${identifierPrefix}AuthorizationActions.retentionApply:
+    case ${identifierPrefix}AuthorizationActions.retentionMaintenance:
+    case ${identifierPrefix}AuthorizationActions.retentionReport:
+      return '${name}:data-retention-job';
+    default:
+      return undefined;
+  }
+}
+
+export function create${pascalName}CoarseAdmission(stage: string) {
+  return defineCoarseAdmission({
+    anyOf: [
+      {
+        kinds: ['admin', 'customer'],
+        subjectTypes: ['user'],
+      },
+      {
+        anyScope: Object.values(${identifierPrefix}MachineScopes(stage)),
+        kinds: ['agent'],
+        subjectTypes: ['service'],
+      },
+    ],
+  });
+}
+
+/**
+ * Product actions and rules are seeded and Slice-owned. Keep policy inputs
+ * minimal and advance the version whenever observable allow/deny behavior
+ * changes.
+ */
+export const ${identifierPrefix}AuthorizationPolicy =
+  defineAuthorizationPolicy<${pascalName}AuthorizationInput>({
+    version: '1.0.0',
+    evaluate(input) {
+      const { action, principal, resource } = input;
+
+      const internalWorkloadIdentity =
+        ${identifierPrefix}InternalWorkloadIdentityForAction(action);
+      if (internalWorkloadIdentity !== undefined) {
+        return principal.kind === 'agent' &&
+          principal.actor.type === 'service' &&
+          principal.actor.id === internalWorkloadIdentity &&
+          principal.subject.id === internalWorkloadIdentity &&
+          principal.authority.mode === 'machine' &&
+          principal.authority.machineIdentityId === internalWorkloadIdentity &&
+          principal.scopes.length === 0 &&
+          resource.type === 'slice' &&
+          resource.attributes.collection === true
+          ? { decision: 'allow' }
+          : { decision: 'deny' };
+      }
+
+      if (
+        action ===
+          ${identifierPrefix}AuthorizationActions.machineProofRead &&
+        (principal.kind !== 'agent' ||
+          principal.actor.type !== 'service' ||
+          principal.subject.type !== 'service' ||
+          principal.authority.mode !== 'machine')
+      ) {
+        return { decision: 'deny' };
+      }
+
+      const directHuman =
+        principal.actor.type === 'user' &&
+        principal.subject.type === 'user' &&
+        principal.authority.mode === 'direct';
+      if (
+        action === ${identifierPrefix}AuthorizationActions.recordWrite &&
+        resource.attributes.syntheticTestData === true &&
+        (!directHuman ||
+          !principal.roles.includes('${name}-test-writer'))
+      ) {
+        return { decision: 'deny' };
+      }
+      if (
+        action === ${identifierPrefix}AuthorizationActions.recordExport
+      ) {
+        return directHuman &&
+          resource.type === 'record' &&
+          resource.attributes.ownerId === principal.actor.id
+          ? { decision: 'allow' }
+          : { decision: 'deny' };
+      }
+      if (
+        action ===
+          ${identifierPrefix}AuthorizationActions.recordExportCleanup ||
+        action === ${identifierPrefix}AuthorizationActions.recordHoldManage
+      ) {
+        return directHuman && principal.kind === 'admin'
+          ? { decision: 'allow' }
+          : { decision: 'deny' };
+      }
+
+      // A direct, authenticated admin remains an independently testable
+      // recovery authority. No generated universal break-glass role exists.
+      if (
+        principal.kind === 'admin' &&
+        principal.actor.type === 'user' &&
+        principal.authority.mode === 'direct'
+      ) {
+        return { decision: 'allow' };
+      }
+
+      if (
+        action === ${identifierPrefix}AuthorizationActions.approvalReview ||
+        action === ${identifierPrefix}AuthorizationActions.retentionReview
+      ) {
+        return { decision: 'deny' };
+      }
+
+      // Cognito client-credentials callers are admitted only for an exact
+      // action scope; an audience match alone never authorizes.
+      if (
+        principal.kind === 'agent' &&
+        principal.actor.type === 'service' &&
+        principal.authority.mode === 'machine'
+      ) {
+        const requiredScope = ${identifierPrefix}MachineScopeForAction(
+          action,
+          input.context.stage,
+        );
+        return requiredScope !== undefined &&
+          principal.scopes.includes(requiredScope)
+          ? { decision: 'allow' }
+          : { decision: 'deny' };
+      }
+
+      if (!recordActions.has(action)) {
+        return principal.actor.type === 'user' &&
+          principal.authority.mode === 'direct'
+          ? { decision: 'allow' }
+          : { decision: 'deny' };
+      }
+
+      // The use endpoint is admitted only for the generated machine scope.
+      // Its second decision is evaluated below under delegated authority.
+      if (
+        action === ${identifierPrefix}AuthorizationActions.recordDelegationUse
+      ) {
+        return { decision: 'deny' };
+      }
+
+      const effectiveOwner =
+        principal.authority.mode === 'delegated'
+          ? principal.authority.delegatedBy.id
+          : principal.actor.type === 'user' &&
+              principal.authority.mode === 'direct'
+            ? principal.actor.id
+            : undefined;
+      return resource.type === 'record' &&
+        effectiveOwner !== undefined &&
+        resource.attributes.ownerId === effectiveOwner
+          ? { decision: 'allow' }
+          : { decision: 'deny' };
+    },
+  });
+`,
+        'authorization/runtime.ts': `import { createHash } from 'node:crypto';
+import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import {
+  createBetterAuthConfig,
+  type Principal,
+} from '@empire-builder-kit/runtime/auth';
+import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
+import type { ApiAuthorizationInput } from '@empire-builder-kit/runtime/api-server';
+import type { ApiOperationDefinition } from '@empire-builder-kit/runtime/api-contract';
+import {
+  createAuthorizationEvaluator,
+  composeAuthorizationPrincipal,
+  createDirectAuthorizationPrincipal,
+  createMachineAuthorizationPrincipal,
+  defineCoarseAdmission,
+  toAuthorizationAuditRecord,
+  type AuthorizationDecision,
+  type AuthorizationDecisionSinkInput,
+  type AuthorizationObligation,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+import {
+  ${identifierPrefix}AuthorizationActions,
+  ${identifierPrefix}MachineScopes,
+  ${identifierPrefix}AuthorizationPolicy,
+  create${pascalName}CoarseAdmission,
+  type ${pascalName}AuthorizationAction,
+  type ${pascalName}AuthorizationInput,
+  type ${pascalName}AuthorizationResource,
+} from './policy.js';
+
+let guard: ReturnType<typeof createAuthGuard> | undefined;
+
+function acceptedMachineClientIds(): readonly string[] {
+  const current = process.env.AUTH_MACHINE_CLIENT_ID;
+  const encoded = process.env.AUTH_MACHINE_ACCEPTED_CLIENT_IDS;
+  if (current === undefined && encoded === undefined) return [];
+  if (!current || !encoded || !isBoundedSafeReference(current)) {
+    throw new Error('Machine authorization client configuration is invalid.');
+  }
+  let candidate: unknown;
+  try {
+    candidate = JSON.parse(encoded);
+  } catch {
+    throw new Error('Machine authorization client configuration is invalid.');
+  }
+  if (
+    !Array.isArray(candidate) ||
+    candidate.length < 1 ||
+    candidate.length > 2 ||
+    new Set(candidate).size !== candidate.length ||
+    candidate.some(
+      (clientId) =>
+        typeof clientId !== 'string' ||
+        !isBoundedSafeReference(clientId),
+    ) ||
+    !candidate.includes(current)
+  ) {
+    throw new Error('Machine authorization client configuration is invalid.');
+  }
+  return Object.freeze([...candidate] as string[]);
+}
+
+function getGuard() {
+  const stage = process.env.EBK_STAGE ?? '';
+  const webClientId = process.env.AUTH_CLIENT_ID ?? '';
+  const machineClientIds = acceptedMachineClientIds();
+  return guard ??= createAuthGuard({
+    config: createBetterAuthConfig({
+      clientId: webClientId,
+      region: process.env.AWS_REGION ?? '',
+      userPoolId: process.env.AUTH_USER_POOL_ID ?? '',
+    }),
+    verifierOptions: {
+      acceptedClientIds: [webClientId, ...machineClientIds],
+    },
+    policy: {
+      admin: { groups: ['${name}-admin'] },
+      agent: {
+        scopes: Object.values(${identifierPrefix}MachineScopes(stage)),
+      },
+      defaultKind: 'customer',
+    },
+  });
+}
+
+function operationAction(
+  operation: ApiOperationDefinition,
+): ${pascalName}AuthorizationAction {
+  if (operation.authorizationActions.length !== 1) {
+    throw new Error(
+      'Standard protected operations require exactly one Slice-owned authorization action.',
+    );
+  }
+  const action = operation.authorizationActions[0];
+  if (
+    !Object.values(${identifierPrefix}AuthorizationActions).includes(
+      action as ${pascalName}AuthorizationAction,
+    )
+  ) {
+    throw new Error('The API operation declares an unknown authorization action.');
+  }
+  return action as ${pascalName}AuthorizationAction;
+}
+
+async function operationResource(
+  operation: ApiOperationDefinition,
+  request: unknown,
+  ownerId: string,
+  correlationId: string,
+): Promise<${pascalName}AuthorizationResource> {
+  const candidate = request as {
+    body?: { testExpiresAt?: unknown };
+    path?: { delegationId?: unknown; recordId?: unknown };
+    query?: { approvalRequestId?: unknown };
+  };
+  const recordId = candidate.path?.recordId;
+  const recordAction = operation.authorizationActions[0]?.includes(':record-');
+  if (recordAction) {
+    if (typeof recordId !== 'string') {
+      throw new Error(
+        'A record authorization action requires its validated record path.',
+      );
+    }
+    const existing = await withPrimaryDatabase(
+      { correlationId },
+      'api-database-records',
+      async (client) => {
+        const record = await client.query<{ ownerId: string }>(
+          \`SELECT owner_id AS "ownerId"
+           FROM records
+           WHERE id = $1::uuid\`,
+          [recordId],
+        );
+        if (record.rows[0]) return record.rows[0];
+
+        const delegationId = candidate.path?.delegationId;
+        if (
+          operation.authorizationActions[0] ===
+            ${identifierPrefix}AuthorizationActions.recordDelegationRevoke &&
+          typeof delegationId === 'string'
+        ) {
+          const delegation = await client.query<{
+            grantJson: {
+              delegator?: { id?: unknown };
+              resourceBoundary?: {
+                kind?: unknown;
+                resourceIds?: unknown;
+                resourceType?: unknown;
+              };
+            };
+          }>(
+            \`SELECT grant_json AS "grantJson"
+             FROM delegation_grants
+             WHERE id = $1::uuid\`,
+            [delegationId],
+          );
+          const grant = delegation.rows[0]?.grantJson;
+          if (
+            grant?.resourceBoundary?.kind === 'exact' &&
+            grant.resourceBoundary.resourceType === 'record' &&
+            Array.isArray(grant.resourceBoundary.resourceIds) &&
+            grant.resourceBoundary.resourceIds.includes(recordId) &&
+            typeof grant.delegator?.id === 'string'
+          ) {
+            return { ownerId: grant.delegator.id };
+          }
+        }
+
+        // A deletion retry may run after primary deletion committed. Only its
+        // exact durable approval can recover the original owner boundary; a
+        // bare missing row remains unauthorized.
+        const approvalRequestId = candidate.query?.approvalRequestId;
+        if (
+          operation.authorizationActions[0] !==
+            ${identifierPrefix}AuthorizationActions.recordDelete ||
+          typeof approvalRequestId !== 'string'
+        ) {
+          return undefined;
+        }
+        const approval = await client.query<{ ownerId: string }>(
+          \`SELECT author_reference AS "ownerId"
+           FROM approval_requests
+           WHERE id = $1::uuid
+             AND request_json->'resource'->>'id' = $2
+             AND request_json->>'action' = $3\`,
+          [
+            approvalRequestId,
+            recordId,
+            ${identifierPrefix}AuthorizationActions.recordDelete,
+          ],
+        );
+        return approval.rows[0];
+      },
+    );
+    const missingOwnerId =
+      operation.authorizationActions[0] ===
+      ${identifierPrefix}AuthorizationActions.recordWrite
+        ? ownerId
+        : 'missing-resource-owner';
+    return {
+      // PUT may authorize creation against the caller's owner boundary.
+      // Read/deletion misses use a non-owner sentinel so missing and adjacent
+      // protected identifiers produce the same denial class.
+      attributes: {
+        ownerId: existing?.ownerId ?? missingOwnerId,
+        syntheticTestData: candidate.body?.testExpiresAt !== undefined,
+      },
+      id: recordId,
+      type: 'record',
+    };
+  }
+  return { attributes: { collection: true }, type: 'slice' };
+}
+
+function pseudonymousSubjectId(subjectId: string): string {
+  return createHash('sha256').update('${name}\\0' + subjectId).digest('hex');
+}
+
+function pseudonymousResourceReference(
+  resourceId: string | undefined,
+): string | undefined {
+  return resourceId === undefined
+    ? undefined
+    : 'sha256:' +
+        createHash('sha256')
+          .update('${name}\\0resource\\0' + resourceId)
+          .digest('hex');
+}
+
+export type ${pascalName}AuthorizationDecisionSink = (
+  input: AuthorizationDecisionSinkInput<${pascalName}AuthorizationInput, never>,
+) => Promise<void> | void;
+
+async function persistAuthorizationDecision<
+  Obligation extends AuthorizationObligation,
+>(
+  decisionInput: ${pascalName}AuthorizationInput,
+  decision: AuthorizationDecision<Obligation>,
+  correlationId: string,
+  workload:
+    | 'api-database-records'
+    | 'data-export-cleanup'
+    | 'data-retention-job'
+    | 'event-consumer',
+) {
+  const audit = toAuthorizationAuditRecord(decisionInput, decision, {
+    correlationId,
+    pseudonymousSubjectId: pseudonymousSubjectId(
+      decisionInput.principal.actor.id,
+    ),
+    resourceReference: pseudonymousResourceReference(
+      decisionInput.resource.id,
+    ),
+    slice: '${name}',
+    stage: decisionInput.context.stage,
+    timestamp: decisionInput.context.now,
+  });
+  await withPrimaryDatabase(
+    { correlationId },
+    workload,
+    (client) =>
+      client.query(
+        \`INSERT INTO authorization_audit
+           (action, approval_reference, authority_mode, correlation_id,
+            decision, delegation_reference, policy_version,
+            principal_kind, pseudonymous_subject_id, reason_category,
+            resource_reference, resource_type, slice, stage, subject_type)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
+                 $13, $14, $15)\`,
+        [
+          audit.action,
+          null,
+          audit.authorityMode,
+          audit.correlationId,
+          audit.decision,
+          decisionInput.principal.authority.mode === 'delegated'
+            ? decisionInput.principal.authority.delegationId
+            : null,
+          audit.policyVersion,
+          decisionInput.principal.kind,
+          audit.pseudonymousSubjectId,
+          audit.reasonCategory,
+          audit.resourceReference ?? null,
+          audit.resourceType,
+          audit.slice,
+          audit.stage,
+          decisionInput.principal.actor.type,
+        ],
+      ),
+  );
+  return audit;
+}
+
+export async function authorize${pascalName}InternalOperation(input: {
+  action:
+    | typeof ${identifierPrefix}AuthorizationActions.dataExportCleanup
+    | typeof ${identifierPrefix}AuthorizationActions.lifecycleConsume
+    | typeof ${identifierPrefix}AuthorizationActions.retentionApply
+    | typeof ${identifierPrefix}AuthorizationActions.retentionMaintenance
+    | typeof ${identifierPrefix}AuthorizationActions.retentionReport;
+  correlationId: string;
+  operationId: string;
+  workloadIdentity: string;
+}): Promise<void> {
+  const principal: AuthorizationPrincipal = {
+    actor: { id: input.workloadIdentity, type: 'service' },
+    audience: input.workloadIdentity,
+    authority: {
+      machineIdentityId: input.workloadIdentity,
+      mode: 'machine',
+    },
+    kind: 'agent',
+    roles: [],
+    scopes: [],
+    subject: { id: input.workloadIdentity, type: 'service' },
+  };
+  const authorizationInput: ${pascalName}AuthorizationInput = {
+    action: input.action,
+    context: {
+      facts: { operationId: input.operationId },
+      now: new Date().toISOString(),
+      stage: process.env.EBK_STAGE ?? 'development',
+    },
+    principal,
+    resource: { attributes: { collection: true }, type: 'slice' },
+  };
+  const evaluator = createAuthorizationEvaluator({
+    admission: defineCoarseAdmission({
+      anyOf: [{ kinds: ['agent'], subjectTypes: ['service'] }],
+    }),
+    policy: ${identifierPrefix}AuthorizationPolicy,
+    decisionSink: async ({ decision, input: decisionInput }) => {
+      await persistAuthorizationDecision(
+        decisionInput,
+        decision,
+        input.correlationId,
+        input.action ===
+          ${identifierPrefix}AuthorizationActions.lifecycleConsume
+          ? 'event-consumer'
+          : input.action ===
+              ${identifierPrefix}AuthorizationActions.dataExportCleanup
+            ? 'data-export-cleanup'
+            : 'data-retention-job',
+      );
+    },
+  });
+  await evaluator.authorize(authorizationInput);
+}
+
+async function evaluate${pascalName}Operation<
+  Operation extends ApiOperationDefinition,
+>(
+  input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+): Promise<{
+  authenticated: Principal;
+  principal: AuthorizationPrincipal;
+}> {
+  const authenticated = await getGuard().authorize(input.event, {
+    logger: input.logger,
+  });
+  const action = operationAction(input.operation);
+  const recognizedMachineScopes = Object.values(
+    ${identifierPrefix}MachineScopes(process.env.EBK_STAGE ?? ''),
+  ).filter((scope) => authenticated.scopes.includes(scope));
+  const principal =
+    authenticated.session.subject.type === 'service'
+      ? recognizedMachineScopes.length > 0
+        ? createMachineAuthorizationPrincipal(authenticated, {
+            audience: authenticated.audience ?? '',
+            capability: action,
+            machineIdentityId: authenticated.id,
+            requiredScopes: recognizedMachineScopes,
+            slice: '${name}',
+          })
+        : composeAuthorizationPrincipal(authenticated, {
+            machineIdentityId: authenticated.id,
+            mode: 'machine',
+          })
+      : createDirectAuthorizationPrincipal(authenticated);
+  const effectiveOwnerId =
+    principal.authority.mode === 'delegated'
+      ? principal.authority.delegatedBy.id
+      : authenticated.id;
+  const authorizationInput: ${pascalName}AuthorizationInput = {
+    action,
+    context: {
+      facts: { operationId: input.operation.operationId },
+      now: new Date().toISOString(),
+      stage: process.env.EBK_STAGE ?? 'development',
+    },
+    principal,
+    resource: await operationResource(
+      input.operation,
+      input.request,
+      effectiveOwnerId,
+      input.context.correlationId,
+    ),
+  };
+  const evaluator = createAuthorizationEvaluator({
+    admission: create${pascalName}CoarseAdmission(
+      authorizationInput.context.stage,
+    ),
+    policy: ${identifierPrefix}AuthorizationPolicy,
+    decisionSink: async ({ decision, input: decisionInput }) => {
+      const audit = await persistAuthorizationDecision(
+        decisionInput,
+        decision,
+        input.context.correlationId,
+        'api-database-records',
+      );
+      input.logger.info('Authorization decision evaluated', {
+        attributes: {
+          action: audit.action,
+          authorityMode: audit.authorityMode,
+          decision: audit.decision,
+          policyVersion: audit.policyVersion,
+          reasonCategory: audit.reasonCategory,
+          resourceType: audit.resourceType,
+        },
+        outcome: decision.decision === 'allow' ? 'success' : 'failure',
+      });
+    },
+  });
+  await evaluator.authorize(authorizationInput);
+  return { authenticated, principal };
+}
+
+export async function authorize${pascalName}Operation<
+  Operation extends ApiOperationDefinition,
+>(
+  input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+): Promise<Principal> {
+  return (await evaluate${pascalName}Operation(input)).authenticated;
+}
+
+/**
+ * Data-rights services receive the exact rich principal that was evaluated,
+ * rather than reconstructing authority from the transport principal.
+ */
+export async function authorize${pascalName}DataRightsOperation<
+  Operation extends ApiOperationDefinition,
+>(
+  input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+): Promise<AuthorizationPrincipal> {
+  return (await evaluate${pascalName}Operation(input)).principal;
+}
+`,
+        'authorization/store.ts': `import type {
+  ApprovalRequest,
+  DelegationGrant,
+  DelegationStore,
+} from '@empire-builder-kit/runtime/authorization';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+import type { ${pascalName}AuthorizationAction } from './policy.js';
+
+/**
+ * Slice-owned online delegation state. The opaque capability is never stored;
+ * grantJson contains only the runtime's digest-bearing safe grant record.
+ */
+export function create${pascalName}DelegationStore(
+  correlationId: string,
+): DelegationStore<${pascalName}AuthorizationAction> {
+  return {
+    async create(grant) {
+      const result = await withPrimaryDatabase(
+        { correlationId },
+        'api-database-records',
+        (client) =>
+          client.query(
+            \`INSERT INTO delegation_grants
+               (id, capability_digest, expires_at, grant_json, issued_at,
+                policy_version, revision, status)
+             VALUES ($1::uuid, $2, $3, $4::jsonb, $5, $6, $7, $8)
+             ON CONFLICT (id) DO NOTHING\`,
+            [
+              grant.id,
+              grant.capabilityDigest,
+              grant.expiresAt,
+              JSON.stringify(grant),
+              grant.issuedAt,
+              grant.issuedUnderPolicyVersion,
+              grant.revision,
+              grant.status,
+            ],
+          ),
+      );
+      return result.rowCount === 1;
+    },
+    async read(delegationId) {
+      const result = await withPrimaryDatabase(
+        { correlationId },
+        'api-database-records',
+        (client) =>
+          client.query<{ grantJson: DelegationGrant<${pascalName}AuthorizationAction> }>(
+            \`SELECT grant_json AS "grantJson"
+             FROM delegation_grants
+             WHERE id = $1::uuid\`,
+            [delegationId],
+          ),
+      );
+      return result.rows[0]?.grantJson;
+    },
+    async write(delegationId, expectedRevision, grant) {
+      const result = await withPrimaryDatabase(
+        { correlationId },
+        'api-database-records',
+        (client) =>
+          client.query(
+            \`UPDATE delegation_grants
+             SET capability_digest = $3,
+                 expires_at = $4,
+                 grant_json = $5::jsonb,
+                 policy_version = $6,
+                 revision = $7,
+                 status = $8
+             WHERE id = $1::uuid AND revision = $2\`,
+            [
+              delegationId,
+              expectedRevision,
+              grant.capabilityDigest,
+              grant.expiresAt,
+              JSON.stringify(grant),
+              grant.issuedUnderPolicyVersion,
+              grant.revision,
+              grant.status,
+            ],
+          ),
+      );
+      return result.rowCount === 1;
+    },
+  };
+}
+
+export interface ${pascalName}ApprovalStore {
+  create(
+    request: ApprovalRequest<${pascalName}AuthorizationAction>,
+  ): Promise<boolean>;
+  read(
+    requestId: string,
+  ): Promise<ApprovalRequest<${pascalName}AuthorizationAction> | undefined>;
+  write(
+    requestId: string,
+    expectedRevision: number,
+    request: ApprovalRequest<${pascalName}AuthorizationAction>,
+  ): Promise<boolean>;
+}
+
+/**
+ * Approval transitions are persisted with the same compare-and-set boundary
+ * used by delegation, so two reviewers or executors cannot claim one request.
+ */
+export function create${pascalName}ApprovalStore(
+  correlationId: string,
+): ${pascalName}ApprovalStore {
+  return {
+    async create(request) {
+      const result = await withPrimaryDatabase(
+        { correlationId },
+        'api-database-records',
+        (client) =>
+          client.query(
+            \`INSERT INTO approval_requests
+               (id, author_reference, expires_at, policy_version,
+                request_digest, request_json, revision, status)
+             VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)
+             ON CONFLICT (id) DO NOTHING\`,
+            [
+              request.id,
+              request.author.effectiveHumanId ?? request.author.actorId,
+              request.expiresAt,
+              request.policyVersion,
+              request.requestDigest,
+              JSON.stringify(request),
+              request.revision,
+              request.status,
+            ],
+          ),
+      );
+      return result.rowCount === 1;
+    },
+    async read(requestId) {
+      const result = await withPrimaryDatabase(
+        { correlationId },
+        'api-database-records',
+        (client) =>
+          client.query<{ requestJson: ApprovalRequest<${pascalName}AuthorizationAction> }>(
+            \`SELECT request_json AS "requestJson"
+             FROM approval_requests
+             WHERE id = $1::uuid\`,
+            [requestId],
+          ),
+      );
+      return result.rows[0]?.requestJson;
+    },
+    async write(requestId, expectedRevision, request) {
+      const result = await withPrimaryDatabase(
+        { correlationId },
+        'api-database-records',
+        (client) =>
+          client.query(
+            \`UPDATE approval_requests
+             SET expires_at = $3,
+                 policy_version = $4,
+                 request_digest = $5,
+                 request_json = $6::jsonb,
+                 revision = $7,
+                 status = $8
+             WHERE id = $1::uuid AND revision = $2\`,
+            [
+              requestId,
+              expectedRevision,
+              request.expiresAt,
+              request.policyVersion,
+              request.requestDigest,
+              JSON.stringify(request),
+              request.revision,
+              request.status,
+            ],
+          ),
+      );
+      return result.rowCount === 1;
+    },
+  };
+}
+`,
+        'authorization/workflows.ts': `import { createHash } from 'node:crypto';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import {
+  assertAuthorizationAllowed,
+  createAuthorizationEvaluator,
+  createDirectAuthorizationPrincipal,
+  createMachineAuthorizationPrincipal,
+  issueDelegation,
+  revokeDelegation,
+  useDelegation,
+  type AuthorizationDecision,
+  type AuthorizationPrincipal,
+  type DelegationGrant,
+  type IssuedDelegation,
+} from '@empire-builder-kit/runtime/authorization';
+import { RuntimeError } from '@empire-builder-kit/runtime/response';
+import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+import {
+  ${identifierPrefix}AuthorizationActions,
+  ${identifierPrefix}AuthorizationPolicy,
+  ${identifierPrefix}MachineScopes,
+  create${pascalName}CoarseAdmission,
+  type ${pascalName}AuthorizationAction,
+  type ${pascalName}AuthorizationInput,
+} from './policy.js';
+import { create${pascalName}DelegationStore } from './store.js';
+
+const POLICY_VERSION = ${identifierPrefix}AuthorizationPolicy.version;
+
+interface RecordResult {
+  id: string;
+  name: string;
+  runScope: string;
+}
+
+function stage(): string {
+  return process.env.EBK_STAGE ?? 'development';
+}
+
+function acceptedMachineClientIds(): readonly string[] {
+  const current = process.env.AUTH_MACHINE_CLIENT_ID ?? '';
+  const encoded = process.env.AUTH_MACHINE_ACCEPTED_CLIENT_IDS ?? '';
+  let candidate: unknown;
+  try {
+    candidate = JSON.parse(encoded);
+  } catch {
+    unavailable();
+  }
+  if (
+    !Array.isArray(candidate) ||
+    candidate.length < 1 ||
+    candidate.length > 2 ||
+    new Set(candidate).size !== candidate.length ||
+    candidate.some(
+      (clientId) =>
+        !isBoundedSafeReference(clientId),
+    ) ||
+    !isBoundedSafeReference(current) ||
+    !candidate.includes(current)
+  ) {
+    unavailable();
+  }
+  return candidate as string[];
+}
+
+function machineClientId(): string {
+  const value = process.env.AUTH_MACHINE_CLIENT_ID ?? '';
+  if (
+    !isBoundedSafeReference(value) ||
+    !acceptedMachineClientIds().includes(value)
+  ) {
+    unavailable();
+  }
+  return value;
+}
+
+function authenticatedMachineClientId(principal: Principal): string {
+  const value = principal.audience;
+  if (
+    principal.kind !== 'agent' ||
+    principal.session.subject.type !== 'service' ||
+    typeof value !== 'string' ||
+    principal.id !== value ||
+    !acceptedMachineClientIds().includes(value)
+  ) {
+    denied();
+  }
+  return value;
+}
+
+function pseudonymousReference(namespace: string, value: string): string {
+  return (
+    'sha256:' +
+    createHash('sha256')
+      .update('${name}\\0' + namespace + '\\0' + value)
+      .digest('hex')
+  );
+}
+
+function invalidInput(): never {
+  throw new RuntimeError({
+    code: 'authorization_input_invalid',
+    message: 'Authorization input is invalid.',
+    retryable: false,
+    status: 403,
+  });
+}
+
+function denied(): never {
+  throw new RuntimeError({
+    code: 'authorization_denied',
+    message: 'Authorization denied.',
+    retryable: false,
+    status: 403,
+  });
+}
+
+function notFound(): never {
+  throw new RuntimeError({
+    code: 'record_not_found',
+    message: 'The record was not found.',
+    retryable: false,
+    status: 404,
+  });
+}
+
+function unavailable(): never {
+  throw new RuntimeError({
+    code: 'authorization_unavailable',
+    message: 'Authorization is temporarily unavailable.',
+    retryable: true,
+    status: 503,
+  });
+}
+
+function targetMachinePrincipal(): AuthorizationPrincipal {
+  const clientId = machineClientId();
+  return {
+    actor: { id: clientId, type: 'service' },
+    audience: clientId,
+    authority: { machineIdentityId: clientId, mode: 'machine' },
+    kind: 'agent',
+    roles: [],
+    scopes: [${identifierPrefix}MachineScopes(stage()).delegationUse],
+    subject: { id: clientId, type: 'service' },
+  };
+}
+
+async function writeDelegationAudit(input: {
+  action: ${pascalName}AuthorizationAction;
+  correlationId: string;
+  decision: AuthorizationDecision;
+  delegationId: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+  reasonCategory: string;
+}): Promise<void> {
+  await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    (client) =>
+      client.query(
+        \`INSERT INTO authorization_audit
+           (action, approval_reference, authority_mode, correlation_id,
+            decision, delegation_reference, policy_version, principal_kind,
+            pseudonymous_subject_id, reason_category, resource_reference,
+            resource_type, slice, stage, subject_type)
+         VALUES ($1, NULL, $2, $3, $4, $5, $6, $7, $8, $9, $10,
+                 'record', $11, $12, $13)\`,
+        [
+          input.action,
+          input.principal.authority.mode,
+          input.correlationId,
+          input.decision.decision,
+          pseudonymousReference('delegation', input.delegationId),
+          input.decision.policyVersion,
+          input.principal.kind,
+          pseudonymousReference('subject', input.principal.actor.id),
+          input.reasonCategory,
+          pseudonymousReference('record', input.recordId),
+          '${name}',
+          stage(),
+          input.principal.actor.type,
+        ],
+      ),
+  );
+}
+
+export async function issue${pascalName}RecordDelegation(input: {
+  correlationId: string;
+  expiresAt: string;
+  principal: Principal;
+  purposeReference: string;
+  recordId: string;
+}): Promise<IssuedDelegation<${pascalName}AuthorizationAction>> {
+  const now = new Date();
+  const expiresAt = Date.parse(input.expiresAt);
+  if (
+    !isBoundedSafeReference(input.purposeReference) ||
+    !Number.isFinite(expiresAt) ||
+    expiresAt <= now.getTime() ||
+    expiresAt - now.getTime() > 60 * 60 * 1_000
+  ) {
+    invalidInput();
+  }
+  const ownership = await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    (client) =>
+      client.query<{ ownerId: string }>(
+        \`SELECT owner_id AS "ownerId"
+         FROM records
+         WHERE id = $1::uuid\`,
+        [input.recordId],
+      ),
+  );
+  if (ownership.rows[0]?.ownerId !== input.principal.id) denied();
+  const delegator = createDirectAuthorizationPrincipal(input.principal);
+  let issued: IssuedDelegation<${pascalName}AuthorizationAction>;
+  try {
+    issued = await issueDelegation(
+      create${pascalName}DelegationStore(input.correlationId),
+      {
+        actions: [${identifierPrefix}AuthorizationActions.recordRead],
+        agent: targetMachinePrincipal(),
+        audience: machineClientId(),
+        capabilityScopes: [
+          ${identifierPrefix}MachineScopes(stage()).delegationUse,
+        ],
+        delegator,
+        expiresAt: new Date(expiresAt).toISOString(),
+        issuedUnderPolicyVersion: POLICY_VERSION,
+        maxUses: 20,
+        now: now.toISOString(),
+        purposeReference: input.purposeReference,
+        rateLimit: { maximumUses: 5, windowSeconds: 60 },
+        resourceBoundary: {
+          kind: 'exact',
+          resourceIds: [input.recordId],
+          resourceType: 'record',
+        },
+        slice: '${name}',
+      },
+    );
+  } catch {
+    unavailable();
+  }
+  const decision = {
+    decision: 'allow',
+    obligations: [],
+    policyVersion: POLICY_VERSION,
+  } as const;
+  await writeDelegationAudit({
+    action: ${identifierPrefix}AuthorizationActions.recordDelegationIssue,
+    correlationId: input.correlationId,
+    decision,
+    delegationId: issued.grant.id,
+    principal: delegator,
+    recordId: input.recordId,
+    reasonCategory: 'delegation-issued',
+  });
+  return issued;
+}
+
+export async function use${pascalName}RecordDelegation(input: {
+  capability: string;
+  correlationId: string;
+  delegationId: string;
+  principal: Principal;
+  recordId: string;
+}): Promise<RecordResult> {
+  const currentStage = stage();
+  const requiredScope =
+    ${identifierPrefix}MachineScopes(currentStage).delegationUse;
+  const authenticatedClientId = authenticatedMachineClientId(input.principal);
+  let machine: AuthorizationPrincipal;
+  try {
+    machine = createMachineAuthorizationPrincipal(input.principal, {
+      audience: authenticatedClientId,
+      capability:
+        ${identifierPrefix}AuthorizationActions.recordDelegationUse,
+      machineIdentityId: authenticatedClientId,
+      requiredScopes: [requiredScope],
+      slice: '${name}',
+    });
+  } catch {
+    denied();
+  }
+  const owner = await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    (client) =>
+      client.query<{ ownerId: string }>(
+        \`SELECT owner_id AS "ownerId"
+         FROM records
+         WHERE id = $1::uuid\`,
+        [input.recordId],
+      ),
+  );
+  const resource = {
+    attributes: {
+      ownerId: owner.rows[0]?.ownerId ?? 'missing-resource-owner',
+    },
+    id: input.recordId,
+    type: 'record' as const,
+  };
+  const context = {
+    facts: { operationId: '${name}.use-record-delegation' },
+    now: new Date().toISOString(),
+    stage: currentStage,
+  };
+  const result = await useDelegation({
+    action: ${identifierPrefix}AuthorizationActions.recordRead,
+    agent: machine,
+    audience: authenticatedClientId,
+    capability: input.capability,
+    context,
+    delegationId: input.delegationId,
+    evaluator: createAuthorizationEvaluator<${pascalName}AuthorizationInput>({
+      admission: create${pascalName}CoarseAdmission(currentStage),
+      policy: ${identifierPrefix}AuthorizationPolicy,
+    }),
+    resolveDelegator: ({ delegator, resource: currentResource }) =>
+      currentResource.attributes.ownerId === delegator.id
+        ? {
+            actor: delegator,
+            authority: { mode: 'direct' },
+            kind: 'customer',
+            roles: [],
+            scopes: [],
+            subject: delegator,
+          }
+        : undefined,
+    requiredCapabilityScopes: [requiredScope],
+    resource,
+    store: create${pascalName}DelegationStore(input.correlationId),
+  });
+  const auditPrincipal = result.principal ?? machine;
+  await writeDelegationAudit({
+    action: ${identifierPrefix}AuthorizationActions.recordRead,
+    correlationId: input.correlationId,
+    decision: result.decision,
+    delegationId: input.delegationId,
+    principal: auditPrincipal,
+    recordId: input.recordId,
+    reasonCategory:
+      result.decision.decision === 'allow'
+        ? 'delegation-used'
+        : result.decision.category,
+  });
+  assertAuthorizationAllowed(result.decision);
+  if (!result.grant || !owner.rows[0]) notFound();
+
+  const record = await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    (client) =>
+      client.query<RecordResult>(
+        \`SELECT id::text, name, run_scope AS "runScope"
+         FROM records
+         WHERE id = $1::uuid AND owner_id = $2\`,
+        [input.recordId, result.grant?.delegator.id],
+      ),
+  );
+  return record.rows[0] ?? notFound();
+}
+
+function grantMatchesRecord(
+  grant: DelegationGrant<${pascalName}AuthorizationAction>,
+  recordId: string,
+): boolean {
+  return (
+    grant.resourceBoundary.kind === 'exact' &&
+    grant.resourceBoundary.resourceType === 'record' &&
+    grant.resourceBoundary.resourceIds.includes(recordId)
+  );
+}
+
+export async function revoke${pascalName}RecordDelegation(input: {
+  correlationId: string;
+  delegationId: string;
+  principal: Principal;
+  recordId: string;
+}): Promise<DelegationGrant<${pascalName}AuthorizationAction>> {
+  const store = create${pascalName}DelegationStore(input.correlationId);
+  const grant = await store.read(input.delegationId);
+  const revoker = createDirectAuthorizationPrincipal(input.principal);
+  if (
+    !grant ||
+    !grantMatchesRecord(grant, input.recordId) ||
+    (input.principal.kind !== 'admin' &&
+      grant.delegator.id !== input.principal.id)
+  ) {
+    denied();
+  }
+  const revoked = await revokeDelegation(store, {
+    delegationId: input.delegationId,
+    now: new Date().toISOString(),
+    revokedBy: revoker,
+  });
+  if (!revoked) denied();
+  const decision = {
+    decision: 'allow',
+    obligations: [],
+    policyVersion: POLICY_VERSION,
+  } as const;
+  await writeDelegationAudit({
+    action: ${identifierPrefix}AuthorizationActions.recordDelegationRevoke,
+    correlationId: input.correlationId,
+    decision,
+    delegationId: revoked.id,
+    principal: revoker,
+    recordId: input.recordId,
+    reasonCategory: 'delegation-revoked',
+  });
+  return revoked;
+}
+`,
+        'authorization/machine-authorization-proof.ts': `import {
+  createMachineTokenProvider,
+  type MachineTokenExchangeResult,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  bindServerSecretRuntime,
+  createAwsSecretsManagerSource,
+  createServerSecretResolver,
+  defineSecrets,
+  secret,
+} from '@empire-builder-kit/runtime/secrets';
+
+interface MachineCredentialDocument {
+  clientId: string;
+  clientSecret: string;
+  generation: string;
+}
+
+const MachineAuthorizationSecrets = defineSecrets({
+  ${pascalName}MachineClientCredential: {
+    cache: { freshTtlMs: 0, staleTtlMs: 0 },
+    owner: '${name}',
+    requiredStages: ['development', 'staging', 'production'],
+    retention: { mode: 'retain' },
+    rotation: {
+      mode: 'manual',
+      runbook: 'docs/runbooks/rotate-machine-authorization.md',
+    },
+    source: 'aws-managed',
+    value: secret.json<MachineCredentialDocument>({
+      validate(value): value is MachineCredentialDocument {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+          return false;
+        }
+        const candidate = value as Partial<MachineCredentialDocument>;
+        return (
+          typeof candidate.clientId === 'string' &&
+          typeof candidate.clientSecret === 'string' &&
+          typeof candidate.generation === 'string' &&
+          candidate.clientSecret.length >= 1 &&
+          candidate.clientSecret.length <= 4_096 &&
+          /^(?:blue|green)-[1-9][0-9]{0,11}$/.test(candidate.generation)
+        );
+      },
+    }),
+  },
+});
+
+function requiredEnvironment(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value || value.length > 2_048 || /[\\r\\n]/.test(value)) {
+    throw new Error('Machine authorization proof configuration is invalid.');
+  }
+  return value;
+}
+
+function credentialDocument(
+  candidate: MachineCredentialDocument,
+): MachineCredentialDocument {
+  if (
+    candidate.clientId !== requiredEnvironment('AUTH_MACHINE_CLIENT_ID')
+  ) {
+    throw new Error('Machine authorization credential is invalid.');
+  }
+  return candidate;
+}
+
+function machineCredentialResolver() {
+  return createServerSecretResolver({
+    binding: bindServerSecretRuntime({
+      stage: requiredEnvironment('EBK_STAGE'),
+      workload: '${name}:machine-authorization-proof',
+    }),
+    cache: { freshTtlMs: 0, staleTtlMs: 0 },
+    source: createAwsSecretsManagerSource(),
+  });
+}
+
+async function exchange(input: {
+  audience: string;
+  clientId: string;
+  clientSecret: string;
+  scopes: readonly string[];
+}): Promise<MachineTokenExchangeResult> {
+  const response = await fetch(
+    requiredEnvironment('AUTH_MACHINE_TOKEN_ENDPOINT'),
+    {
+      body: new URLSearchParams({
+        grant_type: 'client_credentials',
+        scope: input.scopes.join(' '),
+      }),
+      headers: {
+        authorization:
+          'Basic ' +
+          Buffer.from(input.clientId + ':' + input.clientSecret).toString(
+            'base64',
+          ),
+        'content-type': 'application/x-www-form-urlencoded',
+      },
+      method: 'POST',
+      signal: AbortSignal.timeout(10_000),
+    },
+  );
+  if (!response.ok) {
+    throw new Error('Machine token exchange was denied.');
+  }
+  const value = (await response.json()) as {
+    access_token?: unknown;
+    expires_in?: unknown;
+    scope?: unknown;
+    token_type?: unknown;
+  };
+  const expiresIn = Number(value.expires_in);
+  const scopes =
+    typeof value.scope === 'string'
+      ? value.scope.split(/\\s+/).filter(Boolean)
+      : [];
+  if (
+    typeof value.access_token !== 'string' ||
+    value.token_type !== 'Bearer' ||
+    !Number.isFinite(expiresIn) ||
+    expiresIn < 1
+  ) {
+    throw new Error('Machine token exchange returned an invalid response.');
+  }
+  return {
+    accessToken: value.access_token,
+    audience: input.audience,
+    expiresAt: Date.now() / 1_000 + expiresIn,
+    scopes,
+    tokenType: 'Bearer',
+  };
+}
+
+export async function handler() {
+  const clientId = requiredEnvironment('AUTH_MACHINE_CLIENT_ID');
+  const scope = requiredEnvironment('AUTH_MACHINE_PROOF_SCOPE');
+  let generation = 'unresolved';
+  const provider = createMachineTokenProvider({
+    audience: requiredEnvironment('AUTH_MACHINE_RESOURCE_SERVER'),
+    clientId,
+    exchange,
+    machineIdentityId: clientId,
+    resolveClientSecret: async () => {
+      const credential = credentialDocument(
+        await machineCredentialResolver().get(
+          MachineAuthorizationSecrets.${pascalName}MachineClientCredential,
+          {
+            logicalName:
+              MachineAuthorizationSecrets.${pascalName}MachineClientCredential
+                .logicalName,
+            provider: 'aws-secrets-manager',
+            secretArn: requiredEnvironment(
+              'AUTH_MACHINE_CLIENT_SECRET_ARN',
+            ),
+          },
+        ),
+      );
+      generation = credential.generation;
+      return { value: credential.clientSecret };
+    },
+    scopes: [scope],
+  });
+  const token = await provider.getToken();
+  const response = await fetch(
+    requiredEnvironment('AUTH_MACHINE_PROBE_URL'),
+    {
+      headers: { authorization: token.tokenType + ' ' + token.accessToken },
+      method: 'GET',
+      signal: AbortSignal.timeout(10_000),
+    },
+  );
+  if (response.status !== 200) {
+    throw new Error('Machine authorization allow probe was denied.');
+  }
+  return {
+    audit: provider.auditSnapshot(),
+    clientId,
+    credentialGeneration: generation,
+    outcome: 'success' as const,
+    probeStatus: response.status,
+    scope,
+  };
+}
+`,
+        'authorization/policy.spec.ts': `import {
+  createAuthorizationEvaluator,
+  defineCoarseAdmission,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import { describe, expect, it } from 'vitest';
+import {
+  ${identifierPrefix}AuthorizationActions,
+  ${identifierPrefix}MachineScopes,
+  ${identifierPrefix}AuthorizationPolicy,
+  create${pascalName}CoarseAdmission,
+  type ${pascalName}AuthorizationAction,
+  type ${pascalName}AuthorizationInput,
+} from './policy.js';
+
+function principal(
+  overrides: Partial<AuthorizationPrincipal> = {},
+): AuthorizationPrincipal {
+  return {
+    actor: { id: 'subject-owner', type: 'user' },
+    authority: { mode: 'direct' },
+    kind: 'customer',
+    roles: [],
+    scopes: [],
+    subject: { id: 'subject-owner', type: 'user' },
+    ...overrides,
+  };
+}
+
+function input(
+  overrides: Partial<${pascalName}AuthorizationInput> = {},
+): ${pascalName}AuthorizationInput {
+  return {
+    action: ${identifierPrefix}AuthorizationActions.recordRead,
+    context: {
+      facts: { operationId: '${name}.get-record' },
+      now: '2026-07-27T12:00:00.000Z',
+      stage: 'development',
+    },
+    principal: principal(),
+    resource: {
+      attributes: { ownerId: 'subject-owner' },
+      id: '00000000-0000-4000-8000-000000000001',
+      type: 'record',
+    },
+    ...overrides,
+  };
+}
+
+describe('${pascalName} authorization policy', () => {
+  const evaluator = createAuthorizationEvaluator({
+    admission: create${pascalName}CoarseAdmission('development'),
+    policy: ${identifierPrefix}AuthorizationPolicy,
+  });
+
+  it('allows an owner and denies an adjacent resource', async () => {
+    await expect(evaluator.evaluate(input())).resolves.toMatchObject({
+      decision: 'allow',
+    });
+    await expect(
+      evaluator.evaluate(
+        input({
+          resource: {
+            attributes: { ownerId: 'subject-adjacent' },
+            id: '00000000-0000-4000-8000-000000000002',
+            type: 'record',
+          },
+        }),
+      ),
+    ).resolves.toMatchObject({
+      category: 'domain-authorization-denied',
+      decision: 'deny',
+    });
+  });
+
+  it('limits TTL-bearing synthetic records to the generated test-writer role', async () => {
+    const syntheticResource = {
+      attributes: {
+        ownerId: 'subject-owner',
+        syntheticTestData: true,
+      },
+      id: '00000000-0000-4000-8000-000000000001',
+      type: 'record' as const,
+    };
+    await expect(
+      evaluator.evaluate(
+        input({
+          action: ${identifierPrefix}AuthorizationActions.recordWrite,
+          resource: syntheticResource,
+        }),
+      ),
+    ).resolves.toMatchObject({
+      category: 'domain-authorization-denied',
+      decision: 'deny',
+    });
+    await expect(
+      evaluator.evaluate(
+        input({
+          action: ${identifierPrefix}AuthorizationActions.recordWrite,
+          principal: principal({ roles: ['${name}-test-writer'] }),
+          resource: syntheticResource,
+        }),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+  });
+
+  it('separates owner export from direct-admin cleanup and hold authority', async () => {
+    await expect(
+      evaluator.evaluate(
+        input({
+          action: ${identifierPrefix}AuthorizationActions.recordExport,
+        }),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    const admin = principal({
+      actor: { id: 'admin-reviewer', type: 'user' },
+      kind: 'admin',
+      roles: ['${name}-admin'],
+      subject: { id: 'admin-reviewer', type: 'user' },
+    });
+    await expect(
+      evaluator.evaluate(
+        input({
+          action: ${identifierPrefix}AuthorizationActions.recordExport,
+          principal: admin,
+        }),
+      ),
+    ).resolves.toMatchObject({ decision: 'deny' });
+    await expect(
+      evaluator.evaluate(
+        input({
+          action:
+            ${identifierPrefix}AuthorizationActions.recordExportCleanup,
+        }),
+      ),
+    ).resolves.toMatchObject({ decision: 'deny' });
+    for (const action of [
+      ${identifierPrefix}AuthorizationActions.recordExportCleanup,
+      ${identifierPrefix}AuthorizationActions.recordHoldManage,
+    ]) {
+      await expect(
+        evaluator.evaluate(input({ action, principal: admin })),
+      ).resolves.toMatchObject({ decision: 'allow' });
+    }
+  });
+
+  it('requires an exact action scope for a machine principal', async () => {
+    const machine = principal({
+      actor: { id: 'machine-client', type: 'service' },
+      audience: 'machine-client',
+      authority: {
+        machineIdentityId: 'machine-client',
+        mode: 'machine',
+      },
+      kind: 'agent',
+      scopes: [
+        ${identifierPrefix}MachineScopes('development').delegationUse,
+      ],
+      subject: { id: 'machine-client', type: 'service' },
+    });
+    await expect(
+      evaluator.evaluate(input({ principal: machine })),
+    ).resolves.toMatchObject({
+      category: 'domain-authorization-denied',
+      decision: 'deny',
+    });
+    await expect(
+      evaluator.evaluate(
+        input({
+          action: ${identifierPrefix}AuthorizationActions.machineProofRead,
+          principal: {
+            ...machine,
+            scopes: [
+              ${identifierPrefix}MachineScopes('development').proofReader,
+            ],
+          },
+        }),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    await expect(
+      evaluator.evaluate(
+        input({
+          principal: {
+            ...machine,
+            scopes: ['${name}-development/record-read'],
+          },
+        }),
+      ),
+    ).resolves.toMatchObject({
+      category: 'admission-scope-denied',
+      decision: 'deny',
+    });
+  });
+
+  it('fails closed for system and non-agent service principals', async () => {
+    for (const unsupported of [
+      principal({
+        actor: { id: 'system-subject', type: 'system' },
+        audience: 'system-subject',
+        authority: {
+          machineIdentityId: 'system-subject',
+          mode: 'machine',
+        },
+        kind: 'agent',
+        subject: { id: 'system-subject', type: 'system' },
+      }),
+      principal({
+        actor: { id: 'service-member', type: 'service' },
+        kind: 'customer',
+        subject: { id: 'service-member', type: 'service' },
+      }),
+    ]) {
+      await expect(
+        evaluator.evaluate(input({ principal: unsupported })),
+      ).resolves.toMatchObject({ decision: 'deny' });
+    }
+  });
+
+  it('keeps the machine proof action unavailable to direct humans', async () => {
+    for (const directHuman of [
+      principal(),
+      principal({
+        actor: { id: 'admin-reviewer', type: 'user' },
+        kind: 'admin',
+        roles: ['${name}-admin'],
+        subject: { id: 'admin-reviewer', type: 'user' },
+      }),
+    ]) {
+      await expect(
+        evaluator.evaluate(
+          input({
+            action: ${identifierPrefix}AuthorizationActions.machineProofRead,
+            principal: directHuman,
+            resource: { attributes: { collection: true }, type: 'slice' },
+          }),
+        ),
+      ).resolves.toMatchObject({
+        category: 'domain-authorization-denied',
+        decision: 'deny',
+      });
+    }
+  });
+
+  it('allows only exact internal workload action and identity pairs', async () => {
+    const internalEvaluator = createAuthorizationEvaluator({
+      admission: defineCoarseAdmission({
+        anyOf: [{ kinds: ['agent'], subjectTypes: ['service'] }],
+      }),
+      policy: ${identifierPrefix}AuthorizationPolicy,
+    });
+    const service = (identity: string): AuthorizationPrincipal =>
+      principal({
+        actor: { id: identity, type: 'service' },
+        audience: identity,
+        authority: { machineIdentityId: identity, mode: 'machine' },
+        kind: 'agent',
+        scopes: [],
+        subject: { id: identity, type: 'service' },
+      });
+    const internalInput = (
+      action: ${pascalName}AuthorizationAction,
+      identity: string,
+    ): ${pascalName}AuthorizationInput =>
+      input({
+        action,
+        principal: service(identity),
+        resource: { attributes: { collection: true }, type: 'slice' },
+      });
+
+    await expect(
+      internalEvaluator.evaluate(
+        internalInput(
+          ${identifierPrefix}AuthorizationActions.lifecycleConsume,
+          '${name}:event-consumer',
+        ),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    await expect(
+      internalEvaluator.evaluate(
+        internalInput(
+          ${identifierPrefix}AuthorizationActions.retentionApply,
+          '${name}:data-retention-job',
+        ),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    await expect(
+      internalEvaluator.evaluate(
+        internalInput(
+          ${identifierPrefix}AuthorizationActions.retentionReport,
+          '${name}:data-retention-job',
+        ),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    await expect(
+      internalEvaluator.evaluate(
+        internalInput(
+          ${identifierPrefix}AuthorizationActions.retentionMaintenance,
+          '${name}:data-retention-job',
+        ),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    await expect(
+      internalEvaluator.evaluate(
+        internalInput(
+          ${identifierPrefix}AuthorizationActions.dataExportCleanup,
+          '${name}:data-export-cleanup',
+        ),
+      ),
+    ).resolves.toMatchObject({ decision: 'allow' });
+    for (const rejected of [
+      internalInput(
+        ${identifierPrefix}AuthorizationActions.dataExportCleanup,
+        '${name}:data-retention-job',
+      ),
+      internalInput(
+        ${identifierPrefix}AuthorizationActions.retentionApply,
+        '${name}:event-consumer',
+      ),
+      internalInput(
+        ${identifierPrefix}AuthorizationActions.retentionReport,
+        '${name}:event-consumer',
+      ),
+      internalInput(
+        ${identifierPrefix}AuthorizationActions.retentionMaintenance,
+        '${name}:event-consumer',
+      ),
+      internalInput(
+        ${identifierPrefix}AuthorizationActions.lifecycleConsume,
+        'ordinary-machine-client',
+      ),
+      input({
+        action: ${identifierPrefix}AuthorizationActions.lifecycleConsume,
+        principal: principal(),
+        resource: { attributes: { collection: true }, type: 'slice' },
+      }),
+    ]) {
+      await expect(
+        internalEvaluator.evaluate(rejected),
+      ).resolves.toMatchObject({ decision: 'deny' });
+    }
+  });
+
+  it('fails closed when the policy evaluator is unavailable', async () => {
+    const unavailable = createAuthorizationEvaluator<${pascalName}AuthorizationInput>({
+      admission: create${pascalName}CoarseAdmission('development'),
+      policy: {
+        evaluate() {
+          throw new Error('provider unavailable');
+        },
+        version: '1.0.0',
+      },
+    });
+    await expect(unavailable.evaluate(input())).resolves.toMatchObject({
+      category: 'authorization-unavailable',
+      decision: 'deny',
+    });
+  });
+});
+`,
+        'authorization/workflows.spec.ts': `import {
+  authorizeApprovalExecution,
+  beginApprovalExecution,
+  createApprovalRequest,
+  createAuthorizationEvaluator,
+  decideApprovalRequest,
+  issueDelegation,
+  revokeDelegation,
+  useDelegation,
+  type AuthorizationPrincipal,
+  type DelegationGrant,
+  type DelegationStore,
+} from '@empire-builder-kit/runtime/authorization';
+import { describe, expect, it } from 'vitest';
+import {
+  ${identifierPrefix}AuthorizationActions,
+  ${identifierPrefix}AuthorizationPolicy,
+  ${identifierPrefix}MachineScopes,
+  create${pascalName}CoarseAdmission,
+  type ${pascalName}AuthorizationAction,
+} from './policy.js';
+
+class MemoryDelegationStore
+  implements DelegationStore<${pascalName}AuthorizationAction>
+{
+  readonly grants = new Map<
+    string,
+    DelegationGrant<${pascalName}AuthorizationAction>
+  >();
+
+  create(grant: DelegationGrant<${pascalName}AuthorizationAction>) {
+    if (this.grants.has(grant.id)) return false;
+    this.grants.set(grant.id, structuredClone(grant));
+    return true;
+  }
+
+  read(id: string) {
+    const grant = this.grants.get(id);
+    return grant ? structuredClone(grant) : undefined;
+  }
+
+  write(
+    id: string,
+    expectedRevision: number,
+    grant: DelegationGrant<${pascalName}AuthorizationAction>,
+  ) {
+    const current = this.grants.get(id);
+    if (!current || current.revision !== expectedRevision) return false;
+    this.grants.set(id, structuredClone(grant));
+    return true;
+  }
+}
+
+function human(id: string, kind: 'admin' | 'customer' = 'customer') {
+  return {
+    actor: { id, type: 'user' as const },
+    authority: { mode: 'direct' as const },
+    kind,
+    roles: kind === 'admin' ? ['${name}-admin'] : [],
+    scopes: [],
+    subject: { id, type: 'user' as const },
+  } satisfies AuthorizationPrincipal;
+}
+
+function agent(): AuthorizationPrincipal {
+  return {
+    actor: { id: '${name}-agent-api', type: 'service' },
+    audience: '${name}-agent-api',
+    authority: {
+      machineIdentityId: '${name}-attended-agent',
+      mode: 'machine',
+    },
+    kind: 'agent',
+    roles: [],
+    scopes: [
+      ${identifierPrefix}MachineScopes('development').delegationUse,
+    ],
+    subject: { id: '${name}-agent-api', type: 'service' },
+  };
+}
+
+const recordId = '00000000-0000-4000-8000-000000000001';
+const context = {
+  facts: { operationId: '${name}.get-record' },
+  now: '2026-07-27T12:01:00.000Z',
+  stage: 'development',
+};
+const resource = {
+  attributes: { ownerId: 'record-owner' },
+  id: recordId,
+  type: 'record' as const,
+};
+
+describe('${pascalName} delegated authorization and approvals', () => {
+  it('uses online delegation within exact bounds and denies rate/revocation', async () => {
+    const store = new MemoryDelegationStore();
+    const actingAgent = agent();
+    const issued = await issueDelegation(store, {
+      actions: [${identifierPrefix}AuthorizationActions.recordRead],
+      agent: actingAgent,
+      audience: '${name}-agent-api',
+      capabilityScopes: [
+        ${identifierPrefix}MachineScopes('development').delegationUse,
+      ],
+      delegator: human('record-owner'),
+      expiresAt: '2026-07-27T12:30:00.000Z',
+      issuedUnderPolicyVersion: '1.0.0',
+      now: '2026-07-27T12:00:00.000Z',
+      purposeReference: 'work-item-123',
+      rateLimit: { maximumUses: 1, windowSeconds: 60 },
+      resourceBoundary: {
+        kind: 'exact',
+        resourceIds: [recordId],
+        resourceType: 'record',
+      },
+      slice: '${name}',
+    });
+    const evaluator = createAuthorizationEvaluator({
+      admission: create${pascalName}CoarseAdmission('development'),
+      policy: ${identifierPrefix}AuthorizationPolicy,
+    });
+    const use = () =>
+      useDelegation({
+        action: ${identifierPrefix}AuthorizationActions.recordRead,
+        agent: actingAgent,
+        audience: '${name}-agent-api',
+        capability: issued.capability,
+        context,
+        delegationId: issued.grant.id,
+        evaluator,
+        resolveDelegator: ({ delegator }) => human(delegator.id),
+        requiredCapabilityScopes: [
+          ${identifierPrefix}MachineScopes('development').delegationUse,
+        ],
+        resource,
+        store,
+      });
+
+    await expect(use()).resolves.toMatchObject({
+      decision: { decision: 'allow' },
+      grant: { usage: { totalUses: 1 } },
+    });
+    await expect(use()).resolves.toMatchObject({
+      decision: {
+        category: 'delegation-rate-limited',
+        decision: 'deny',
+      },
+    });
+    await revokeDelegation(store, {
+      delegationId: issued.grant.id,
+      now: '2026-07-27T12:02:00.000Z',
+      revokedBy: human('record-owner'),
+    });
+    await expect(use()).resolves.toMatchObject({
+      decision: { category: 'delegation-revoked', decision: 'deny' },
+    });
+  });
+
+  it('denies attended use when the delegator no longer owns the resource', async () => {
+    const store = new MemoryDelegationStore();
+    const actingAgent = agent();
+    const issued = await issueDelegation(store, {
+      actions: [${identifierPrefix}AuthorizationActions.recordRead],
+      agent: actingAgent,
+      audience: '${name}-agent-api',
+      capabilityScopes: [
+        ${identifierPrefix}MachineScopes('development').delegationUse,
+      ],
+      delegator: human('former-owner'),
+      expiresAt: '2026-07-27T12:30:00.000Z',
+      issuedUnderPolicyVersion: '1.0.0',
+      now: '2026-07-27T12:00:00.000Z',
+      purposeReference: 'work-item-delegator-ceiling',
+      resourceBoundary: {
+        kind: 'exact',
+        resourceIds: [recordId],
+        resourceType: 'record',
+      },
+      slice: '${name}',
+    });
+    await expect(
+      useDelegation({
+        action: ${identifierPrefix}AuthorizationActions.recordRead,
+        agent: actingAgent,
+        audience: '${name}-agent-api',
+        capability: issued.capability,
+        context,
+        delegationId: issued.grant.id,
+        evaluator: createAuthorizationEvaluator({
+          admission: create${pascalName}CoarseAdmission('development'),
+          policy: ${identifierPrefix}AuthorizationPolicy,
+        }),
+        resolveDelegator: ({ delegator }) => human(delegator.id),
+        requiredCapabilityScopes: [
+          ${identifierPrefix}MachineScopes('development').delegationUse,
+        ],
+        resource,
+        store,
+      }),
+    ).resolves.toMatchObject({
+      decision: {
+        category: 'delegation-out-of-bounds',
+        decision: 'deny',
+      },
+    });
+    expect(store.read(issued.grant.id)?.usage.totalUses).toBe(0);
+  });
+
+  it('denies attended use when the issuing policy version is stale', async () => {
+    const store = new MemoryDelegationStore();
+    const actingAgent = agent();
+    const issued = await issueDelegation(store, {
+      actions: [${identifierPrefix}AuthorizationActions.recordRead],
+      agent: actingAgent,
+      audience: '${name}-agent-api',
+      capabilityScopes: [
+        ${identifierPrefix}MachineScopes('development').delegationUse,
+      ],
+      delegator: human('record-owner'),
+      expiresAt: '2026-07-27T12:30:00.000Z',
+      issuedUnderPolicyVersion: '1.0.0',
+      now: '2026-07-27T12:00:00.000Z',
+      purposeReference: 'work-item-policy-version',
+      resourceBoundary: {
+        kind: 'exact',
+        resourceIds: [recordId],
+        resourceType: 'record',
+      },
+      slice: '${name}',
+    });
+    const evaluator = createAuthorizationEvaluator({
+      admission: create${pascalName}CoarseAdmission('development'),
+      policy: {
+        ...${identifierPrefix}AuthorizationPolicy,
+        version: '2.0.0',
+      },
+    });
+
+    await expect(
+      useDelegation({
+        action: ${identifierPrefix}AuthorizationActions.recordRead,
+        agent: actingAgent,
+        audience: '${name}-agent-api',
+        capability: issued.capability,
+        context,
+        delegationId: issued.grant.id,
+        evaluator,
+        resolveDelegator: ({ delegator }) => human(delegator.id),
+        requiredCapabilityScopes: [
+          ${identifierPrefix}MachineScopes('development').delegationUse,
+        ],
+        resource,
+        store,
+      }),
+    ).resolves.toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+    });
+    expect(store.read(issued.grant.id)?.usage.totalUses).toBe(0);
+  });
+
+  it('denies an expired attended capability online', async () => {
+    const store = new MemoryDelegationStore();
+    const actingAgent = agent();
+    const issued = await issueDelegation(store, {
+      actions: [${identifierPrefix}AuthorizationActions.recordRead],
+      agent: actingAgent,
+      audience: '${name}-agent-api',
+      delegator: human('record-owner'),
+      expiresAt: '2026-07-27T12:02:00.000Z',
+      issuedUnderPolicyVersion: '1.0.0',
+      now: '2026-07-27T12:00:00.000Z',
+      purposeReference: 'work-item-124',
+      resourceBoundary: {
+        kind: 'exact',
+        resourceIds: [recordId],
+        resourceType: 'record',
+      },
+      slice: '${name}',
+    });
+    await expect(
+      useDelegation({
+        action: ${identifierPrefix}AuthorizationActions.recordRead,
+        agent: actingAgent,
+        audience: '${name}-agent-api',
+        capability: issued.capability,
+        context: { ...context, now: '2026-07-27T12:03:00.000Z' },
+        delegationId: issued.grant.id,
+        evaluator: createAuthorizationEvaluator({
+          admission: create${pascalName}CoarseAdmission('development'),
+          policy: ${identifierPrefix}AuthorizationPolicy,
+        }),
+        resolveDelegator: ({ delegator }) => human(delegator.id),
+        resource,
+        store,
+      }),
+    ).resolves.toMatchObject({
+      decision: { category: 'delegation-expired', decision: 'deny' },
+    });
+  });
+
+  it('keeps a high-impact record deletion pending until non-author approval', () => {
+    const command = { reasonCode: 'subject-request', recordId };
+    const pending = createApprovalRequest({
+      action: ${identifierPrefix}AuthorizationActions.recordDelete,
+      author: agent(),
+      command,
+      expiresAt: '2026-07-27T13:00:00.000Z',
+      now: '2026-07-27T12:00:00.000Z',
+      policyVersion: '1.0.0',
+      resource: { id: recordId, type: 'record' },
+      slice: '${name}',
+    });
+    expect(
+      authorizeApprovalExecution(pending, {
+        action: ${identifierPrefix}AuthorizationActions.recordDelete,
+        command,
+        now: '2026-07-27T12:05:00.000Z',
+        requiredPolicyVersion: '1.0.0',
+        resource: { id: recordId, type: 'record' },
+      }),
+    ).toMatchObject({
+      category: 'approval-pending',
+      decision: 'deny',
+    });
+    const approved = decideApprovalRequest(pending, {
+      approver: human('privacy-reviewer', 'admin'),
+      expectedRequestDigest: pending.requestDigest,
+      now: '2026-07-27T12:10:00.000Z',
+      outcome: 'approved',
+      reasonReference: 'review-123',
+      requiredPolicyVersion: '1.0.0',
+    });
+    expect(approved.decision.decision).toBe('allow');
+    expect(
+      beginApprovalExecution(approved.request, {
+        action: ${identifierPrefix}AuthorizationActions.recordDelete,
+        command,
+        executionId: 'deletion-execution-stale',
+        now: '2026-07-27T12:11:00.000Z',
+        requiredPolicyVersion: '2.0.0',
+        resource: { id: recordId, type: 'record' },
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: { status: 'approved' },
+    });
+    expect(
+      beginApprovalExecution(approved.request, {
+        action: ${identifierPrefix}AuthorizationActions.recordDelete,
+        command,
+        executionId: 'deletion-execution-123',
+        now: '2026-07-27T12:11:00.000Z',
+        requiredPolicyVersion: '1.0.0',
+        resource: { id: recordId, type: 'record' },
+      }),
+    ).toMatchObject({
+      decision: { decision: 'allow' },
+      request: { status: 'executing' },
+    });
+    expect(
+      authorizeApprovalExecution(approved.request, {
+        action: ${identifierPrefix}AuthorizationActions.recordDelete,
+        command: { ...command, recordId: recordId.replace(/1$/, '2') },
+        now: '2026-07-27T12:11:00.000Z',
+        requiredPolicyVersion: '1.0.0',
+        resource: { id: recordId, type: 'record' },
+      }),
+    ).toMatchObject({
+      category: 'approval-invalid',
+      decision: 'deny',
+    });
+  });
+
+  it('denies direct self-review of the exact request digest', () => {
+    const author = human('record-owner');
+    const pending = createApprovalRequest({
+      action: ${identifierPrefix}AuthorizationActions.recordDelete,
+      author,
+      command: { recordId },
+      expiresAt: '2026-07-27T13:00:00.000Z',
+      now: '2026-07-27T12:00:00.000Z',
+      policyVersion: '1.0.0',
+      resource: { id: recordId, type: 'record' },
+      slice: '${name}',
+    });
+    expect(
+      decideApprovalRequest(pending, {
+        approver: author,
+        expectedRequestDigest: pending.requestDigest,
+        now: '2026-07-27T12:10:00.000Z',
+        outcome: 'approved',
+        reasonReference: 'self-review',
+        requiredPolicyVersion: '1.0.0',
+      }),
+    ).toMatchObject({
+      decision: { category: 'approval-invalid', decision: 'deny' },
+      request: { status: 'pending' },
+    });
+  });
+});
+`,
+        'docs/runbooks/authorization.md': `# Authorization
+
+Every protected operation declares one Slice-owned action and passes through
+the generated authentication-plus-domain-authorization adapter before business
+logic. The seeded policy in \`authorization/policy.ts\` is deny by default.
+Roles and OAuth scopes are coarse admission only; resource/action policy still
+decides each operation.
+
+Advance the policy version when observable behavior changes. Run
+\`pnpm nx run ${name}:authorization-check\` and review policy compatibility before
+deployment. Permission broadening requires explicit security review; a
+reduction is breaking until callers and recovery authority are reconciled.
+
+The Standard machine client exposes only the exact \`proof-read\` and
+\`delegation-use\` Cognito scopes. It cannot read a product record directly;
+resource access requires the attended, server-side delegation decision.
+Attended delegation uses an audience-bound opaque capability and never exposes
+the delegator's token. Every use resolves the delegator from current
+Slice-owned state and requires both the direct delegator and delegated agent
+policy decisions to allow the exact action and resource. High-impact actions
+use a digest-bound approval from a different direct human. Neither agents nor
+machines may approve their own grant or action.
+
+Deployment provisions the empty \`${name}-admin\` Cognito group used for direct
+human recovery, deletion approval, and retention review. Add or remove group
+membership only through a reviewed identity-administration action; never seed a
+member, reuse the group for machines, or treat group admission as the final
+domain decision.
+
+The generated event consumer and data-retention Job use internal-only
+\`${name}:event-consumer\` and \`${name}:data-retention-job\` workload identities.
+They are not Cognito clients or scopes. Each is accepted only for its exact
+Slice-collection action, and the internal helper must run before the protected
+effect so a missing, swapped, or externally supplied identity fails closed.
+These workloads are represented as \`kind: agent\`, \`subject.type: service\`.
+System subjects and non-agent service principals are intentionally unsupported
+in the Standard v1 policy and receive a default-deny decision.
+
+Audit output contains only pseudonymous subject, action, resource type/safe
+reference, authority mode, decision category, policy version, correlation,
+Slice, stage, and timestamp. Never add tokens, claims, email, record content,
+policy input, roles, or scopes.
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-authorization-files.js.map