@kybernesis/arp-scope-catalog 0.2.0

package/generated/manifest.json

@@ -0,0 +1,1542 @@
+{
+  "version": "v1",
+  "updated_at": "2026-04-24T16:48:20+07:00",
+  "scope_count": 50,
+  "checksum": "sha256:ad278a0843e7b0439b7bc59b0fb56619e9d3e1dddd3df57816a8e0fd9d74cb69",
+  "scopes": [
+    {
+      "id": "calendar.availability.read",
+      "version": "1.0.0",
+      "label": "Check availability (free/busy only)",
+      "description": "Peer can see when you're free or busy, but no event titles, attendees, or details.",
+      "category": "calendar",
+      "risk": "low",
+      "parameters": [
+        {
+          "name": "days_ahead",
+          "type": "Integer",
+          "required": true,
+          "default": 14,
+          "validation": "1..90"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"check_availability\",\n  resource == Calendar::\"primary\"\n) when {\n  context.query_window_days <= {{days_ahead}}\n};\nforbid (\n  principal == Agent::\"{{audience_did}}\",\n  action,\n  resource == Calendar::\"primary\"\n) when {\n  action != Action::\"check_availability\"\n};\n",
+      "consent_text_template": "Check your free/busy (no details) up to {{days_ahead}} days ahead.",
+      "obligations_forced": [
+        {
+          "type": "redact_fields",
+          "params": {
+            "fields": [
+              "event.title",
+              "event.attendees",
+              "event.description",
+              "event.location"
+            ]
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "calendar.events.cancel",
+      "version": "1.0.0",
+      "label": "Cancel events",
+      "description": "Peer can cancel calendar events on your behalf.",
+      "category": "calendar",
+      "risk": "high",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"cancel_event\",\n  resource == Calendar::\"primary\"\n);\n",
+      "consent_text_template": "Cancel calendar events on your behalf.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [
+        "calendar.events.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "calendar.events.create",
+      "version": "1.0.0",
+      "label": "Create events directly",
+      "description": "Peer can create calendar events on your primary calendar without extra confirmation, up to a daily cap.",
+      "category": "calendar",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "max_per_day",
+          "type": "Integer",
+          "required": true,
+          "default": 5,
+          "validation": "1..50"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"create_event\",\n  resource == Calendar::\"primary\"\n) when {\n  context.events_created_today < {{max_per_day}}\n};\n",
+      "consent_text_template": "Create calendar events directly, up to {{max_per_day}} per day.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [
+        "calendar.availability.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "calendar.events.modify",
+      "version": "1.0.0",
+      "label": "Modify existing events",
+      "description": "Peer can modify existing calendar events (reschedule, update details).",
+      "category": "calendar",
+      "risk": "high",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"modify_event\",\n  resource == Calendar::\"primary\"\n);\n",
+      "consent_text_template": "Modify existing calendar events on your behalf.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [
+        "calendar.events.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "calendar.events.propose",
+      "version": "1.0.0",
+      "label": "Propose a meeting",
+      "description": "Peer can propose a meeting. Creates a tentative event pending your confirmation.",
+      "category": "calendar",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "max_attendees",
+          "type": "Integer",
+          "required": true,
+          "default": 10,
+          "validation": "1..50"
+        },
+        {
+          "name": "max_duration_min",
+          "type": "Integer",
+          "required": true,
+          "default": 60,
+          "validation": "15..480"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"propose_meeting\",\n  resource == Calendar::\"primary\"\n) when {\n  context.proposed_attendee_count <= {{max_attendees}} &&\n  context.proposed_duration_min <= {{max_duration_min}}\n};\n",
+      "consent_text_template": "Propose meetings (up to {{max_attendees}} people, {{max_duration_min}} minutes). You confirm before it's booked.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 86400
+          }
+        }
+      ],
+      "implies": [
+        "calendar.availability.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "calendar.events.read",
+      "version": "1.0.0",
+      "label": "Read event details",
+      "description": "Peer can read the details of calendar events within a time window.",
+      "category": "calendar",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "window_days",
+          "type": "Integer",
+          "required": true,
+          "default": 30,
+          "validation": "1..365"
+        },
+        {
+          "name": "include_private",
+          "type": "Enum",
+          "required": false,
+          "default": "no",
+          "validation": [
+            "yes",
+            "no"
+          ]
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource == Calendar::\"primary\"\n) when {\n  context.query_window_days <= {{window_days}}\n  {{#if include_private_flag}}\n  {{else}}\n  && !resource.tags.contains(\"private\")\n  {{/if}}\n};\n",
+      "consent_text_template": "Read event details for the next {{window_days}} days.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [
+        "calendar.availability.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "connection.extend",
+      "version": "1.0.0",
+      "label": "Extend connection expiry",
+      "description": "Peer can request that you extend this connection's expiry by a bounded number of days.",
+      "category": "identity",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "days",
+          "type": "Integer",
+          "required": true,
+          "default": 30,
+          "validation": "1..365"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"extend_connection\",\n  resource == Connection::\"self\"\n) when {\n  context.requested_extension_days <= {{days}}\n};\n",
+      "consent_text_template": "Allow Peer to request a connection extension up to {{days}} days.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "connection.rescope.request",
+      "version": "1.0.0",
+      "label": "Request new scopes",
+      "description": "Peer can ask you to add or adjust scopes on this connection (subject to your approval).",
+      "category": "identity",
+      "risk": "medium",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"request_rescope\",\n  resource == Connection::\"self\"\n);\n",
+      "consent_text_template": "Allow Peer to propose new scopes on this connection.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "contacts.attributes.read",
+      "version": "1.0.0",
+      "label": "Read specific contact attributes",
+      "description": "Peer can read specific attribute fields (e.g., phone, title) on contacts you've identified.",
+      "category": "contacts",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "attributes",
+          "type": "AttributeList",
+          "required": true,
+          "validation": [
+            "name",
+            "email",
+            "phone",
+            "title",
+            "company",
+            "linkedin",
+            "twitter",
+            "notes"
+          ]
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource == Contact\n);\n",
+      "consent_text_template": "Read these contact attributes: {{attributes_display}}.",
+      "obligations_forced": [
+        {
+          "type": "redact_fields_except",
+          "params": {
+            "allowlist": "{{attributes_json}}"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "contacts.introduce",
+      "version": "1.0.0",
+      "label": "Request contact introduction",
+      "description": "Peer can ask you to introduce them to one of your contacts.",
+      "category": "contacts",
+      "risk": "medium",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"request_contact_introduction\",\n  resource == Contact\n);\n",
+      "consent_text_template": "Let Peer ask you for introductions to your contacts.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 86400
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "contacts.search",
+      "version": "1.0.0",
+      "label": "Look up contacts",
+      "description": "Peer can search your contacts and receive only the attributes you specify.",
+      "category": "contacts",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "attribute_allowlist",
+          "type": "AttributeList",
+          "required": true,
+          "default": [
+            "name",
+            "email"
+          ],
+          "validation": [
+            "name",
+            "email",
+            "phone",
+            "title",
+            "company",
+            "linkedin",
+            "twitter",
+            "notes"
+          ]
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"search_contacts\",\n  resource == Contact\n);\n",
+      "consent_text_template": "Search your contacts and see these fields: {{attribute_allowlist_display}}.",
+      "obligations_forced": [
+        {
+          "type": "redact_fields_except",
+          "params": {
+            "allowlist": "{{attribute_allowlist_json}}"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "contacts.share",
+      "version": "1.0.0",
+      "label": "Share a contact card",
+      "description": "Peer can ask you to share a contact's vCard to an allowlisted recipient.",
+      "category": "contacts",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "recipient_allowlist",
+          "type": "EmailList",
+          "required": true,
+          "validation": "rfc5322-or-domain-glob"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"share_external\",\n  resource == Contact\n) when {\n  context.recipient_matches_allowlist({{recipient_allowlist_json}})\n};\n",
+      "consent_text_template": "Share contact cards externally to: {{recipient_allowlist_display}}.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        },
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "credentials.present.request",
+      "version": "1.0.0",
+      "label": "Request specific VCs",
+      "description": "Peer can ask your agent to present specific Verifiable Credentials (full disclosure, not ZK).",
+      "category": "credentials",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "required_vcs",
+          "type": "AttributeList",
+          "required": true,
+          "validation": "vc-type-id"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"present_vc\",\n  resource == Credential\n) when {\n  resource.type in {{required_vcs_json}}\n};\n",
+      "consent_text_template": "Present these credentials: {{required_vcs_display}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "log_zk_disclosure",
+          "params": {}
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "credentials.proof.zk.request",
+      "version": "1.0.0",
+      "label": "Request ZK proof of an attribute",
+      "description": "Peer can ask your agent to present a zero-knowledge proof of a single attribute without revealing the underlying credential. Issuer is method-agnostic — any VC issuer that publishes a compatible predicate proof works.",
+      "category": "credentials",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "attribute",
+          "type": "Enum",
+          "required": true,
+          "validation": [
+            "over_18",
+            "over_21",
+            "us_resident",
+            "verified_human",
+            "country"
+          ]
+        },
+        {
+          "name": "predicate",
+          "type": "Enum",
+          "required": false,
+          "default": "eq",
+          "validation": [
+            "eq",
+            "gte",
+            "lte",
+            "in"
+          ]
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"request_zk_proof\",\n  resource == Credential::\"{{attribute}}\"\n) when {\n  context.predicate == \"{{predicate}}\"\n};\n",
+      "consent_text_template": "Prove to Peer, without revealing details, that you are {{attribute_human}}.",
+      "obligations_forced": [
+        {
+          "type": "log_zk_disclosure",
+          "params": {}
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "delegation.forward.task",
+      "version": "1.0.0",
+      "label": "Forward task to another agent",
+      "description": "Peer can re-delegate a task to a third agent, with automatically attenuated scopes.",
+      "category": "delegation",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "agent_allowlist",
+          "type": "AgentDIDList",
+          "required": true,
+          "validation": "at-least-one"
+        },
+        {
+          "name": "scope_attenuation",
+          "type": "Enum",
+          "required": true,
+          "default": "read_only",
+          "validation": [
+            "read_only",
+            "same_scopes",
+            "custom"
+          ]
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"redelegate\",\n  resource == Connection::\"self\"\n) when {\n  context.delegate_target in {{agent_allowlist_json}} &&\n  context.attenuation_mode == \"{{scope_attenuation}}\"\n};\n",
+      "consent_text_template": "Allow Peer to forward tasks to: {{agent_allowlist_display}}. Forwarded tasks get {{scope_attenuation_human}} access.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "tier_gate": "self_xyz.verified_human",
+      "step_up_required": true
+    },
+    {
+      "id": "files.project.files.delete",
+      "version": "1.0.0",
+      "label": "Delete files",
+      "description": "Peer can delete files in a specific project.",
+      "category": "files",
+      "risk": "critical",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"delete\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "Delete files in project {{project_id}} (destructive).",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        },
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [
+        "files.share.external"
+      ],
+      "tier_gate": "self_xyz.verified_human",
+      "step_up_required": true
+    },
+    {
+      "id": "files.project.files.list",
+      "version": "1.0.0",
+      "label": "List files in a project",
+      "description": "Peer can list the file names in a specific project, not their contents.",
+      "category": "files",
+      "risk": "low",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"list\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "List files in project {{project_id}}.",
+      "obligations_forced": [],
+      "implies": [
+        "files.project.metadata.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "files.project.files.read",
+      "version": "1.0.0",
+      "label": "Read file contents",
+      "description": "Peer can read the contents of files in a specific project.",
+      "category": "files",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "max_size_mb",
+          "type": "Integer",
+          "required": true,
+          "default": 10,
+          "validation": "1..100"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action in [Action::\"read\", Action::\"list\"],\n  resource in Project::\"{{project_id}}\"\n) when {\n  resource.size_bytes <= {{max_size_mb}} * 1048576 &&\n  !resource.tags.contains(\"confidential\") &&\n  !resource.tags.contains(\"do-not-share\")\n};\n",
+      "consent_text_template": "Read files in {{project.name}} (up to {{max_size_mb}} MB each; excludes items tagged confidential).",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [
+        "files.project.files.list",
+        "files.project.metadata.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "files.project.files.summarize",
+      "version": "1.0.0",
+      "label": "Summaries only (derive)",
+      "description": "Peer receives model-generated summaries of files in a project, never the raw contents.",
+      "category": "files",
+      "risk": "low",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "max_output_words",
+          "type": "Integer",
+          "required": true,
+          "default": 2000,
+          "validation": "100..10000"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"summarize\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "Summarize files in project {{project_id}} (up to {{max_output_words}} words).",
+      "obligations_forced": [
+        {
+          "type": "summarize_only",
+          "params": {
+            "max_words": "{{max_output_words}}"
+          }
+        }
+      ],
+      "implies": [
+        "files.project.files.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "files.project.files.write",
+      "version": "1.0.0",
+      "label": "Create/modify files",
+      "description": "Peer can create and modify files in a specific project, up to a maximum size per file.",
+      "category": "files",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "max_size_mb",
+          "type": "Integer",
+          "required": true,
+          "default": 10,
+          "validation": "1..100"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action in [Action::\"write\", Action::\"update\"],\n  resource in Project::\"{{project_id}}\"\n) when {\n  context.written_size_bytes <= {{max_size_mb}} * 1048576\n};\n",
+      "consent_text_template": "Create or modify files in {{project_id}} (up to {{max_size_mb}} MB each).",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [
+        "files.project.files.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "files.project.metadata.read",
+      "version": "1.0.0",
+      "label": "Read project metadata",
+      "description": "Peer can read a specific project's metadata (name, description, tags), not its files.",
+      "category": "files",
+      "risk": "low",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read_metadata\",\n  resource == Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "Read metadata for project {{project_id}}.",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "files.projects.list",
+      "version": "1.0.0",
+      "label": "List projects",
+      "description": "Peer can list project names and IDs from your project registry.",
+      "category": "files",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"list\",\n  resource == ProjectRegistry::\"self\"\n);\n",
+      "consent_text_template": "See the list of your projects (names + IDs only).",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "files.share.external",
+      "version": "1.0.0",
+      "label": "Share files outside circle",
+      "description": "Peer can share files from a project with an external recipient allowlist.",
+      "category": "files",
+      "risk": "critical",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "recipient_allowlist",
+          "type": "EmailList",
+          "required": true,
+          "validation": "rfc5322-or-domain-glob"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"share_external\",\n  resource in Project::\"{{project_id}}\"\n) when {\n  context.recipient_matches_allowlist({{recipient_allowlist_json}})\n};\n",
+      "consent_text_template": "Share files from {{project_id}} externally to: {{recipient_allowlist_display}}.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        },
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        },
+        {
+          "type": "insert_watermark",
+          "params": {}
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [
+        "files.project.files.delete"
+      ],
+      "tier_gate": "self_xyz.verified_human",
+      "step_up_required": true
+    },
+    {
+      "id": "identity.card.read",
+      "version": "1.0.0",
+      "label": "Read agent card",
+      "description": "Allow the peer agent to fetch your agent card (name, supported protocols, public endpoints).",
+      "category": "identity",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource == AgentCard::\"self\"\n);\n",
+      "consent_text_template": "See your public agent card.",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "identity.introduction.request",
+      "version": "1.0.0",
+      "label": "Request introduction",
+      "description": "Peer can ask your agent to introduce them to another agent you know.",
+      "category": "identity",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "to_agent",
+          "type": "AgentDID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"request_introduction\",\n  resource == Agent::\"{{to_agent}}\"\n);\n",
+      "consent_text_template": "Introduce Peer to {{to_agent}}.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 86400
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "identity.principal.verify",
+      "version": "1.0.0",
+      "label": "Verify owner binding",
+      "description": "Peer can fetch and verify your representation VC, confirming which human principal your agent represents.",
+      "category": "identity",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"verify_principal\",\n  resource == Principal::\"self\"\n);\n",
+      "consent_text_template": "Let Peer verify who your agent represents.",
+      "obligations_forced": [],
+      "implies": [
+        "identity.card.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "knowledge.query",
+      "version": "1.0.0",
+      "label": "Query knowledge base",
+      "description": "Peer can query a specific knowledge base and receive token-bounded answers.",
+      "category": "notes",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "kb_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "max_tokens",
+          "type": "Integer",
+          "required": true,
+          "default": 8000,
+          "validation": "100..50000"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"query\",\n  resource == KnowledgeBase::\"{{kb_id}}\"\n) when {\n  context.requested_tokens <= {{max_tokens}}\n};\n",
+      "consent_text_template": "Query knowledge base {{kb_id}} (up to {{max_tokens}} tokens/response).",
+      "obligations_forced": [
+        {
+          "type": "summarize_only",
+          "params": {
+            "max_words": "{{max_tokens}}"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "messaging.chat.send",
+      "version": "1.0.0",
+      "label": "Send chat message",
+      "description": "Peer can send chat messages on your behalf within an allowlisted set of channels.",
+      "category": "messaging",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "channel_allowlist",
+          "type": "AttributeList",
+          "required": true,
+          "validation": "at-least-one"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"send_chat\",\n  resource == ChatChannel\n) when {\n  resource.id in {{channel_allowlist_json}}\n};\n",
+      "consent_text_template": "Send chat messages on your behalf in: {{channel_allowlist_display}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "messaging.email.draft.compose",
+      "version": "1.0.0",
+      "label": "Compose drafts (no send)",
+      "description": "Peer can compose email drafts in your drafts folder without sending them.",
+      "category": "messaging",
+      "risk": "medium",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"compose_draft\",\n  resource == Email::\"drafts\"\n);\nforbid (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"send_email\",\n  resource\n);\n",
+      "consent_text_template": "Compose email drafts for you to review (no sending).",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "messaging.email.send.reviewed",
+      "version": "1.0.0",
+      "label": "Send email (after your review)",
+      "description": "Peer drafts emails on your behalf; each send requires your one-tap approval before going out.",
+      "category": "messaging",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "recipient_allowlist",
+          "type": "EmailList",
+          "required": false,
+          "default": [],
+          "validation": "rfc5322-or-domain-glob"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"send_email\",\n  resource == Email::\"outbox\"\n) when {\n  {{#if recipient_allowlist}}\n  context.recipient_matches_allowlist({{recipient_allowlist_json}})\n  {{else}}\n  true\n  {{/if}}\n};\n",
+      "consent_text_template": "Draft and (with your approval) send emails{{#if recipient_allowlist}} to: {{recipient_allowlist_display}}{{/if}}.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        },
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [
+        "messaging.email.draft.compose"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "messaging.email.summary",
+      "version": "1.0.0",
+      "label": "Email summaries only",
+      "description": "Peer receives only summaries of your email threads, never the raw content.",
+      "category": "messaging",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "label_filter",
+          "type": "AttributeList",
+          "required": false,
+          "default": [],
+          "validation": "label-or-folder-name"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"summarize\",\n  resource == Email\n);\n",
+      "consent_text_template": "Share email summaries (never raw content){{#if label_filter}} for labels: {{label_filter_display}}{{/if}}.",
+      "obligations_forced": [
+        {
+          "type": "summarize_only",
+          "params": {
+            "max_words": 250
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "messaging.email.thread.read",
+      "version": "1.0.0",
+      "label": "Read email threads",
+      "description": "Peer can read the full contents of email threads matching optional label filters.",
+      "category": "messaging",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "label_filter",
+          "type": "AttributeList",
+          "required": false,
+          "default": [],
+          "validation": "label-or-folder-name"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource == Email\n) {{#if label_filter}}when {\n  resource.labels.containsAny({{label_filter_json}})\n}{{/if}};\n",
+      "consent_text_template": "Read email thread contents{{#if label_filter}} for labels: {{label_filter_display}}{{/if}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [
+        "messaging.email.summary"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "messaging.relay.to_principal",
+      "version": "1.0.0",
+      "label": "Relay message to owner",
+      "description": "Peer can ask your agent to relay a short message to you (the principal).",
+      "category": "messaging",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"relay_to_principal\",\n  resource == Principal::\"self\"\n);\n",
+      "consent_text_template": "Let Peer send you short relayed messages.",
+      "obligations_forced": [
+        {
+          "type": "rate_limit",
+          "params": {
+            "window": "hour",
+            "max": 10
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "notes.read",
+      "version": "1.0.0",
+      "label": "Read notes",
+      "description": "Peer can read full note contents in a specific collection.",
+      "category": "notes",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "collection_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource in Collection::\"{{collection_id}}\"\n);\n",
+      "consent_text_template": "Read notes in collection {{collection_id}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [
+        "notes.search"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "notes.search",
+      "version": "1.0.0",
+      "label": "Search notes",
+      "description": "Peer can search notes within a collection and receive title+snippet matches.",
+      "category": "notes",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "collection_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"search\",\n  resource in Collection::\"{{collection_id}}\"\n);\n",
+      "consent_text_template": "Search notes in collection {{collection_id}}.",
+      "obligations_forced": [
+        {
+          "type": "summarize_only",
+          "params": {
+            "max_words": 100
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "notes.write",
+      "version": "1.0.0",
+      "label": "Create/update notes",
+      "description": "Peer can create and update notes in a collection, up to a daily cap.",
+      "category": "notes",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "collection_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "max_per_day",
+          "type": "Integer",
+          "required": true,
+          "default": 100,
+          "validation": "1..1000"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action in [Action::\"write\", Action::\"update\"],\n  resource in Collection::\"{{collection_id}}\"\n) when {\n  context.notes_written_today < {{max_per_day}}\n};\n",
+      "consent_text_template": "Create/update notes in {{collection_id}} (up to {{max_per_day}}/day).",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [
+        "notes.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "payments.authorize.capped",
+      "version": "1.0.0",
+      "label": "Authorize payments up to a cap",
+      "description": "Peer can trigger x402 payments up to the per-transaction and rolling 30-day caps you set.",
+      "category": "payments",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "max_per_txn_usd",
+          "type": "Decimal",
+          "required": true,
+          "default": 5,
+          "validation": "0.01..1000"
+        },
+        {
+          "name": "max_per_30d_usd",
+          "type": "Decimal",
+          "required": true,
+          "default": 50,
+          "validation": "0.01..10000"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"authorize_payment\",\n  resource == Wallet::\"primary\"\n) when {\n  context.quoted_price_usd <= {{max_per_txn_usd}} &&\n  context.spend_last_30d_usd + context.quoted_price_usd <= {{max_per_30d_usd}}\n};\n",
+      "consent_text_template": "Pay up to ${{max_per_txn_usd}} per request, ${{max_per_30d_usd}} total per 30 days.",
+      "obligations_forced": [
+        {
+          "type": "notify_principal",
+          "params": {}
+        },
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "tier_gate": "self_xyz.verified_human",
+      "step_up_required": true
+    },
+    {
+      "id": "payments.history.read",
+      "version": "1.0.0",
+      "label": "Read past transactions",
+      "description": "Peer can read your payment history for the past N days.",
+      "category": "payments",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "days_back",
+          "type": "Integer",
+          "required": true,
+          "default": 30,
+          "validation": "1..365"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource == PaymentHistory::\"self\"\n) when {\n  context.query_window_days <= {{days_back}}\n};\n",
+      "consent_text_template": "Read payment history for the past {{days_back}} days.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "payments.quote.request",
+      "version": "1.0.0",
+      "label": "Request a price quote",
+      "description": "Peer can request a price quote for an action or purchase (quote only, no payment).",
+      "category": "payments",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"request_quote\",\n  resource == Wallet::\"primary\"\n);\n",
+      "consent_text_template": "Let Peer request a price quote (no payment).",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "payments.refund.request",
+      "version": "1.0.0",
+      "label": "Request refund",
+      "description": "Peer can request a refund against a prior payment.",
+      "category": "payments",
+      "risk": "medium",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"request_refund\",\n  resource == Payment\n);\n",
+      "consent_text_template": "Let Peer request a refund on a prior payment.",
+      "obligations_forced": [
+        {
+          "type": "require_principal_confirmation",
+          "params": {
+            "max_age_seconds": 0
+          }
+        },
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "tasks.assign",
+      "version": "1.0.0",
+      "label": "Assign tasks to humans",
+      "description": "Peer can assign tasks in a project to specific people.",
+      "category": "tasks",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"assign\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "Assign tasks to people in project {{project_id}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "notify_principal",
+          "params": {}
+        }
+      ],
+      "implies": [
+        "tasks.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "tasks.create",
+      "version": "1.0.0",
+      "label": "Create tasks",
+      "description": "Peer can create tasks in a project, up to a daily cap.",
+      "category": "tasks",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        },
+        {
+          "name": "max_per_day",
+          "type": "Integer",
+          "required": true,
+          "default": 50,
+          "validation": "1..500"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"create\",\n  resource in Project::\"{{project_id}}\"\n) when {\n  context.tasks_created_today < {{max_per_day}}\n};\n",
+      "consent_text_template": "Create tasks in {{project_id}} (up to {{max_per_day}}/day).",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "tasks.list",
+      "version": "1.0.0",
+      "label": "List tasks",
+      "description": "Peer can list tasks within a project.",
+      "category": "tasks",
+      "risk": "low",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"list\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "List tasks in project {{project_id}}.",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "tasks.read",
+      "version": "1.0.0",
+      "label": "Read task details",
+      "description": "Peer can read details (title, status, assignee, due) of tasks within a project.",
+      "category": "tasks",
+      "risk": "low",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "Read task details in project {{project_id}}.",
+      "obligations_forced": [],
+      "implies": [
+        "tasks.list"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "tasks.status.update",
+      "version": "1.0.0",
+      "label": "Update task status",
+      "description": "Peer can update the status (open/in-progress/done) of tasks in a project.",
+      "category": "tasks",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "project_id",
+          "type": "ProjectID",
+          "required": true
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"update_status\",\n  resource in Project::\"{{project_id}}\"\n);\n",
+      "consent_text_template": "Update task status in {{project_id}}.",
+      "obligations_forced": [],
+      "implies": [
+        "tasks.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "tools.invoke.mutating",
+      "version": "1.0.0",
+      "label": "Invoke tools with side effects",
+      "description": "Peer can invoke specific tools on your MCP server that cause changes (not just reads).",
+      "category": "tools",
+      "risk": "high",
+      "parameters": [
+        {
+          "name": "tool_allowlist",
+          "type": "ToolIDList",
+          "required": true,
+          "validation": "at-least-one"
+        },
+        {
+          "name": "max_per_day",
+          "type": "Integer",
+          "required": true,
+          "default": 20,
+          "validation": "1..1000"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"invoke_tool\",\n  resource == Tool\n) when {\n  resource.id in {{tool_allowlist_json}} &&\n  context.requests_last_day <= {{max_per_day}}\n};\n",
+      "consent_text_template": "Use these tools on your behalf (max {{max_per_day}}/day): {{tool_allowlist_display}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        },
+        {
+          "type": "rate_limit",
+          "params": {
+            "window": "day",
+            "max": "{{max_per_day}}"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": true
+    },
+    {
+      "id": "tools.invoke.read",
+      "version": "1.0.0",
+      "label": "Invoke read-only tools",
+      "description": "Peer can invoke read-only (no-side-effect) tools on your MCP server, restricted to an allowlist.",
+      "category": "tools",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "tool_allowlist",
+          "type": "ToolIDList",
+          "required": true,
+          "validation": "at-least-one"
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"invoke_tool\",\n  resource == Tool\n) when {\n  resource.id in {{tool_allowlist_json}} &&\n  resource.readonly == true\n};\n",
+      "consent_text_template": "Invoke these read-only tools on your behalf: {{tool_allowlist_display}}.",
+      "obligations_forced": [
+        {
+          "type": "audit_level",
+          "params": {
+            "level": "verbose"
+          }
+        }
+      ],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "work.projects.list",
+      "version": "1.0.0",
+      "label": "Current active projects",
+      "description": "Peer can see the list of projects you're actively working on (names only).",
+      "category": "work",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"list\",\n  resource == WorkProjects::\"self\"\n);\n",
+      "consent_text_template": "Share the list of your active projects.",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "work.reports.summary",
+      "version": "1.0.0",
+      "label": "Generate status summary",
+      "description": "Peer can ask your agent to generate a status summary for a bounded time period.",
+      "category": "work",
+      "risk": "medium",
+      "parameters": [
+        {
+          "name": "period",
+          "type": "Enum",
+          "required": true,
+          "default": "week",
+          "validation": [
+            "day",
+            "week",
+            "month",
+            "quarter"
+          ]
+        }
+      ],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"summarize\",\n  resource == WorkReport::\"self\"\n) when {\n  context.period == \"{{period}}\"\n};\n",
+      "consent_text_template": "Generate a {{period}} work status summary.",
+      "obligations_forced": [
+        {
+          "type": "summarize_only",
+          "params": {
+            "max_words": 1000
+          }
+        }
+      ],
+      "implies": [
+        "work.status.read"
+      ],
+      "conflicts_with": [],
+      "step_up_required": false
+    },
+    {
+      "id": "work.status.read",
+      "version": "1.0.0",
+      "label": "Current work status",
+      "description": "Peer can see your current work status (available, busy, out-of-office).",
+      "category": "work",
+      "risk": "low",
+      "parameters": [],
+      "cedar_template": "permit (\n  principal == Agent::\"{{audience_did}}\",\n  action == Action::\"read\",\n  resource == WorkStatus::\"self\"\n);\n",
+      "consent_text_template": "Share your current work status (available/busy/OOO).",
+      "obligations_forced": [],
+      "implies": [],
+      "conflicts_with": [],
+      "step_up_required": false
+    }
+  ]
+}