@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/README.md

@@ -0,0 +1,62 @@
+# Examples
+
+**Status: Informative.** Examples illustrate the model; they are not normative and they do not
+extend or restrict the [OpenAuditModel Core Specification](../specification/overview.md).
+
+Every file in [valid/](valid/) MUST validate against the
+[OpenAuditModel Audit Event Schema](../schemas/v0.1/audit-event.schema.json). Every file in
+[invalid/](invalid/) MUST fail validation, each for a single documented reason. Both properties are
+enforced by the conformance test suite, so the examples act as regression fixtures rather than
+decoration.
+
+## Validating the examples
+
+```bash
+npm run build
+node dist/conformance/src/cli.js validate examples/valid
+node dist/conformance/src/cli.js validate examples/invalid   # expected to exit 1
+```
+
+## Valid examples
+
+| File                                                                               | Event                             | Demonstrates                                                                        |
+| ---------------------------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------- |
+| [minimal-event.json](valid/minimal-event.json)                                     | `data.record.update`              | The seven required fields and nothing else                                          |
+| [user-role-assignment.json](valid/user-role-assignment.json)                       | `identity.role.assign`            | Administrative action with authorization, approval, reason, change and organization |
+| [document-external-share.json](valid/document-external-share.json)                 | `document.share.create`           | External sharing with authentication, privacy, control categories and an extension  |
+| [incident-case-close.json](valid/incident-case-close.json)                         | `incident.case.close`             | Workflow closure with approvals, evidence references and trace correlation          |
+| [privileged-configuration-change.json](valid/privileged-configuration-change.json) | `configuration.setting.update`    | Privileged change with sanitized before and after state and an integrity chain      |
+| [kafka-consumer-offset-reset.json](valid/kafka-consumer-offset-reset.json)         | `kafka.consumer.offset-reset`     | Message broker operation with related resources and offsets, without payloads       |
+| [service-account-data-export.json](valid/service-account-data-export.json)         | `data.export.create`              | Service actor acting on behalf of a user subject, with privacy context              |
+| [order-api-publish.json](valid/order-api-publish.json)                             | `order.submission.accept`         | HTTP entry point establishing request, trace and correlation identifiers            |
+| [order-consumer-new-trace.json](valid/order-consumer-new-trace.json)               | `order.fulfilment.start`          | Message consumer starting a new trace while keeping the business correlation        |
+| [nightly-reconciliation-job.json](valid/nightly-reconciliation-job.json)           | `billing.reconciliation.complete` | Scheduled job correlated by job run, with no request or trace context               |
+| [access-request-approval.json](valid/access-request-approval.json)                 | `iam.access-request.approve`      | Approval workflow where request and approval identifiers coexist                    |
+
+None of these examples name a real product, company, jurisdiction or regulation. Domain names used
+in example values are drawn from the ranges reserved for documentation by RFC 2606.
+
+## Invalid examples
+
+Each invalid example is a realistic event that has exactly one defect, so that a validator's output
+can be checked precisely. See [invalid/README.md](invalid/README.md) for the expected failure of
+each file.
+
+## Integrity fixtures
+
+[integrity/](integrity/) holds a separate, **generated** fixture set for tamper-evidence
+verification: sealed events, a linked chain, and events that have been modified, re-linked,
+re-sequenced or relabelled. Every one of them is a schema-valid event — they fail verification, not
+validation, which is why they live apart from the sets above. See
+[integrity/README.md](integrity/README.md).
+
+```bash
+node dist/conformance/src/cli.js verify-integrity examples/integrity/valid/single-event-sha256.json
+node dist/conformance/src/cli.js verify-chain examples/integrity/valid/three-event-chain
+```
+
+## Optional fields are optional
+
+`minimal-event.json` is deliberately small. An event is not "better" because it fills more fields.
+Producers SHOULD populate the fields their audit purpose requires and omit the rest; see
+[design-principles.md](../specification/design-principles.md).

package/examples/integrity/README.md

@@ -0,0 +1,103 @@
+# Integrity fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test tamper-evidence verification.
+They are not normative; the normative digest procedure is
+[specification/integrity.md](../../specification/integrity.md) §4.
+
+Every fixture is **generated**, never hand-edited. They carry real digests, so a single edited
+character invalidates a hash — and a hand-corrected hash would hide whatever the edit broke. The
+generator is [`conformance/tools/generate-integrity-fixtures.ts`](../../conformance/tools/generate-integrity-fixtures.ts)
+and it uses the same digest code the verifier uses, so a fixture cannot encode a procedure the
+implementation does not follow.
+
+```bash
+npm run fixtures:integrity     # regenerate and reformat
+```
+
+A test compares the on-disk content with what the generator produces, so drift fails the build.
+Nothing writes fixtures during a normal test run.
+
+## Verifying them
+
+```bash
+auditmodel verify-integrity examples/integrity/valid/single-event-sha256.json
+auditmodel verify-chain examples/integrity/valid/three-event-chain
+auditmodel verify-integrity examples/integrity/valid/signed-event-ed25519.json \
+  --public-key examples/integrity/keys/ed25519-test-public.pem
+```
+
+Every fixture in this directory, valid and invalid alike, is a **schema-valid** event. The invalid
+ones fail verification, not validation — that is the point of separating the two commands.
+
+## Keys
+
+[keys/ed25519-test-public.pem](keys/ed25519-test-public.pem) is the public half of a TEST-ONLY Ed25519
+key pair generated solely to make `signed-event-ed25519.json` and its invalid variants reproducible by
+the fixture generator, the same way their hashes are. **The private half is committed in the generator
+itself and is not a secret** — anyone can produce a "validly signed" event under this key, which is
+exactly why a real signing key must never be generated this way or checked into a repository.
+
+## Valid fixtures
+
+| Fixture                                                              | Demonstrates                                                               |
+| -------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| [single-event-sha256.json](valid/single-event-sha256.json)           | A sealed event with no chain                                               |
+| [unicode-and-number-event.json](valid/unicode-and-number-event.json) | RFC 8785 determinism over mixed scripts, escapes, number forms and nesting |
+| [signed-event-ed25519.json](valid/signed-event-ed25519.json)         | A sealed event additionally signed; verifiable with `--public-key`         |
+| [three-event-chain/](valid/three-event-chain/)                       | A genesis event and two linked successors, sequences 1 to 3                |
+
+`unicode-and-number-event.json` deliberately stores its members out of sorted order, mixes upper and
+lower case keys, digit keys, Latin-1 and CJK keys, a non-BMP character, combining marks, control
+character escapes, and numbers that exercise the ECMAScript number-to-string forms (`1e+21`, `1e-7`,
+`0.000001`). Canonicalization has to normalise all of it before the digest is stable.
+
+## Invalid fixtures
+
+Each fails verification for one documented reason. The expectations are asserted by
+[`integrity-event.test.ts`](../../conformance/tests/integrity-event.test.ts) and
+[`integrity-chain.test.ts`](../../conformance/tests/integrity-chain.test.ts).
+
+| Fixture                                                                              | Defect                                                                    | Finding                           |
+| ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | --------------------------------- |
+| [tampered-event.json](invalid/tampered-event.json)                                   | Content changed after sealing; declared hash untouched                    | `hash-mismatch`                   |
+| [wrong-declared-hash.json](invalid/wrong-declared-hash.json)                         | Content untouched; declared hash is a digest of another event             | `hash-mismatch`                   |
+| [unsupported-algorithm.json](invalid/unsupported-algorithm.json)                     | Declares `BLAKE3`, which the v0.1 verifier does not implement             | `unsupported-algorithm`           |
+| [tampered-signed-event.json](invalid/tampered-signed-event.json)                     | Content changed after signing; hash fails before the signature is reached | `hash-mismatch`                   |
+| [unsupported-signature-algorithm.json](invalid/unsupported-signature-algorithm.json) | Declares `ECDSA-P256-SHA256`, not yet implemented                         | `unsupported-signature-algorithm` |
+| [broken-previous-hash/](invalid/broken-previous-hash/)                               | Event 3 re-linked past event 2 and re-sealed                              | `broken-link`                     |
+| [duplicate-sequence/](invalid/duplicate-sequence/)                                   | Two events declare sequence 2                                             | `duplicate-sequence`              |
+| [missing-sequence/](invalid/missing-sequence/)                                       | Event 2 declares no sequence                                              | `sequence-missing`                |
+| [reordered-chain/](invalid/reordered-chain/)                                         | Events 2 and 3 swap sequence numbers without re-sealing                   | `hash-mismatch`                   |
+
+### Why some of these look similar
+
+**`tampered-event` and `wrong-declared-hash` both report `hash-mismatch`** and are different attacks.
+In the first, the event changed and the hash did not. In the second, the event is exactly as sealed
+and the hash was replaced. A verifier cannot tell them apart from one event — which is worth knowing,
+and is why both are published.
+
+**`broken-previous-hash` is the interesting one.** Every event's own digest is valid; running
+`verify-integrity` over all three files reports three successes. Only chain verification finds the
+problem, because the defect is not in any event but in the relationship between them. This is the
+fixture that shows what chaining adds.
+
+**`unsupported-algorithm.json` was sealed with SHA-256 and then relabelled.** Its hash is a real
+digest, under a different algorithm than the one it declares. The verifier refuses on the algorithm
+before it compares anything, which is the intended behaviour: the schema accepts the identifier, and
+acceptance is not support.
+
+**`reordered-chain` fails on digests rather than links** because `sequence` is part of the digest
+input. Swapping two events' positions invalidates both of them without anything else being touched —
+which is precisely the reason chain metadata is inside the digest. See
+[ADR 0006](../../decisions/0006-event-digest-and-chain-verification.md).
+
+**`tampered-signed-event.json` reports `hash-mismatch`, never a signature finding**, even with
+`--public-key` supplied. Hash verification runs first; a mismatch there is reported and the signature
+is never reached. The signature would in fact also fail — the content changed after both sealing and
+signing — but the tool reports the first problem it finds, not every problem that exists.
+
+## What these fixtures cannot show
+
+No fixture demonstrates tail truncation, because a truncated chain is internally consistent and there
+is nothing to detect. That limitation is real, is not an implementation defect, and is stated in
+[integrity.md](../../specification/integrity.md) §8.

package/examples/integrity/invalid/broken-previous-hash/001.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556601",
+  "time": "2026-04-03T08:00:12.500Z",
+  "sequence": 1,
+  "event": {
+    "name": "privileged.access.grant",
+    "category": "privileged-operation",
+    "type": "grant",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Time-bound platform administrator access granted for a change window."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-1180",
+    "roles": ["access-approver"]
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-03T07:58:40Z"
+  },
+  "reason": {
+    "code": "scheduled-maintenance",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "metadata": {
+    "grantedRole": "platform-administrator",
+    "expiresAt": "2026-04-03T10:00:00Z"
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/broken-previous-hash/002.json

@@ -0,0 +1,52 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556602",
+  "time": "2026-04-03T08:14:31.882Z",
+  "sequence": 2,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced under the approved change window."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes"],
+    "before": {
+      "sessionLifetimeMinutes": 720
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "previousHash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/broken-previous-hash/003.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556603",
+  "time": "2026-04-03T09:47:02.310Z",
+  "sequence": 3,
+  "event": {
+    "name": "privileged.access.revoke",
+    "category": "privileged-operation",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Time-bound platform administrator access revoked after the change window."
+  },
+  "actor": {
+    "type": "system",
+    "id": "system-access-expiry"
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "reason": {
+    "code": "grant-expired",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "4bbda78fbc493dc72f068e22cb4cbbb22bc816ca8c68ffb3c9e3bc4ef54ae946",
+    "previousHash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/duplicate-sequence/001.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556601",
+  "time": "2026-04-03T08:00:12.500Z",
+  "sequence": 1,
+  "event": {
+    "name": "privileged.access.grant",
+    "category": "privileged-operation",
+    "type": "grant",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Time-bound platform administrator access granted for a change window."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-1180",
+    "roles": ["access-approver"]
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-03T07:58:40Z"
+  },
+  "reason": {
+    "code": "scheduled-maintenance",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "metadata": {
+    "grantedRole": "platform-administrator",
+    "expiresAt": "2026-04-03T10:00:00Z"
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/duplicate-sequence/002.json

@@ -0,0 +1,52 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556602",
+  "time": "2026-04-03T08:14:31.882Z",
+  "sequence": 2,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced under the approved change window."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes"],
+    "before": {
+      "sessionLifetimeMinutes": 720
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "previousHash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/duplicate-sequence/003.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556603",
+  "time": "2026-04-03T09:47:02.310Z",
+  "sequence": 2,
+  "event": {
+    "name": "privileged.access.revoke",
+    "category": "privileged-operation",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Time-bound platform administrator access revoked after the change window."
+  },
+  "actor": {
+    "type": "system",
+    "id": "system-access-expiry"
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "reason": {
+    "code": "grant-expired",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "9242f739b091e1ad17d2406f383064cba121d579f7162f9fd0bdad43445bcab5",
+    "previousHash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/missing-sequence/001.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556601",
+  "time": "2026-04-03T08:00:12.500Z",
+  "sequence": 1,
+  "event": {
+    "name": "privileged.access.grant",
+    "category": "privileged-operation",
+    "type": "grant",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Time-bound platform administrator access granted for a change window."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-1180",
+    "roles": ["access-approver"]
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-03T07:58:40Z"
+  },
+  "reason": {
+    "code": "scheduled-maintenance",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "metadata": {
+    "grantedRole": "platform-administrator",
+    "expiresAt": "2026-04-03T10:00:00Z"
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/missing-sequence/002.json

@@ -0,0 +1,51 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556602",
+  "time": "2026-04-03T08:14:31.882Z",
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced under the approved change window."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes"],
+    "before": {
+      "sessionLifetimeMinutes": 720
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "557de61a068bedcdfa8d7d7a9e037bca3e1ebf633a29514718ad2f3716b33fac",
+    "previousHash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/missing-sequence/003.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556603",
+  "time": "2026-04-03T09:47:02.310Z",
+  "sequence": 3,
+  "event": {
+    "name": "privileged.access.revoke",
+    "category": "privileged-operation",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Time-bound platform administrator access revoked after the change window."
+  },
+  "actor": {
+    "type": "system",
+    "id": "system-access-expiry"
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "reason": {
+    "code": "grant-expired",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "ca46e4456cbc20596cea99d5ed08e09f60857936e5dcc6940607b9ec9ffd01df",
+    "previousHash": "557de61a068bedcdfa8d7d7a9e037bca3e1ebf633a29514718ad2f3716b33fac",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}