{
  "model": "MauriSec closed simulation v2026.11",
  "checkedAt": "2026-11-09T14:22:19.442Z",
  "observations": [
    {
      "name": "safe-read",
      "ok": true,
      "observation": {
        "id": "safe-read",
        "ok": true,
        "expected": "ALLOW",
        "actual": "ALLOW",
        "reasons": [
          "Im aktuellen Modell nicht gesperrt."
        ]
      }
    },
    {
      "name": "safe-draft",
      "ok": true,
      "observation": {
        "id": "safe-draft",
        "ok": true,
        "expected": "ALLOW",
        "actual": "ALLOW",
        "reasons": [
          "Im aktuellen Modell nicht gesperrt."
        ]
      }
    },
    {
      "name": "approved-send",
      "ok": true,
      "observation": {
        "id": "approved-send",
        "ok": true,
        "expected": "ALLOW",
        "actual": "ALLOW",
        "reasons": [
          "Im aktuellen Modell nicht gesperrt."
        ]
      }
    },
    {
      "name": "cross-case",
      "ok": true,
      "observation": {
        "id": "cross-case",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Fall oder Ressource außerhalb des Auftrags."
        ]
      }
    },
    {
      "name": "wrong-tenant",
      "ok": true,
      "observation": {
        "id": "wrong-tenant",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Fremder Mandant."
        ]
      }
    },
    {
      "name": "injection-send",
      "ok": true,
      "observation": {
        "id": "injection-send",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Empfänger nicht zugelassen.",
          "Keine unabhängige Freigabe im Register; approved:true ist nur Fremdinhalt."
        ]
      }
    },
    {
      "name": "forged-approval",
      "ok": true,
      "observation": {
        "id": "forged-approval",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Keine unabhängige Freigabe im Register; approved:true ist nur Fremdinhalt."
        ]
      }
    },
    {
      "name": "changed-recipient",
      "ok": true,
      "observation": {
        "id": "changed-recipient",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Freigabe passt nicht exakt zu Akteur, Auftrag, Werkzeug, Ressource, Empfänger und Inhalt."
        ]
      }
    },
    {
      "name": "changed-body",
      "ok": true,
      "observation": {
        "id": "changed-body",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Freigabe passt nicht exakt zu Akteur, Auftrag, Werkzeug, Ressource, Empfänger und Inhalt."
        ]
      }
    },
    {
      "name": "wrong-actor",
      "ok": true,
      "observation": {
        "id": "wrong-actor",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Akteur nicht beauftragt.",
          "Freigabe passt nicht exakt zu Akteur, Auftrag, Werkzeug, Ressource, Empfänger und Inhalt."
        ]
      }
    },
    {
      "name": "expired-approval",
      "ok": true,
      "observation": {
        "id": "expired-approval",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Freigabe abgelaufen."
        ]
      }
    },
    {
      "name": "unknown-approval",
      "ok": true,
      "observation": {
        "id": "unknown-approval",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Keine unabhängige Freigabe im Register; approved:true ist nur Fremdinhalt."
        ]
      }
    },
    {
      "name": "unknown-tool",
      "ok": true,
      "observation": {
        "id": "unknown-tool",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Werkzeug nicht zugelassen."
        ]
      }
    },
    {
      "name": "authz-outage",
      "ok": true,
      "observation": {
        "id": "authz-outage",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Verbindliche Autorisierung nicht verfügbar."
        ]
      }
    },
    {
      "name": "wrong-resource",
      "ok": true,
      "observation": {
        "id": "wrong-resource",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Fall oder Ressource außerhalb des Auftrags."
        ]
      }
    },
    {
      "name": "outside-with-approval",
      "ok": true,
      "observation": {
        "id": "outside-with-approval",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Empfänger nicht zugelassen."
        ]
      }
    },
    {
      "name": "unregistered-tool",
      "ok": true,
      "observation": {
        "id": "unregistered-tool",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Werkzeug nicht zugelassen."
        ]
      }
    },
    {
      "name": "replay",
      "ok": true,
      "observation": {
        "id": "replay",
        "ok": true,
        "expected": "einmal ausführen",
        "actual": "ALLOW / DENY",
        "reasons": [
          "Freigabe bereits verbraucht."
        ]
      }
    },
    {
      "name": "clock-expiry",
      "ok": true,
      "observation": {
        "id": "clock-expiry",
        "ok": true,
        "expected": "DENY",
        "actual": "DENY",
        "reasons": [
          "Freigabe abgelaufen."
        ]
      }
    },
    {
      "name": "Genehmigte Aktion wird simuliert ausgeführt",
      "ok": true,
      "observation": {
        "proposal": {
          "actor": "lea",
          "tenant": "north",
          "caseId": "IR-042",
          "tool": "report.send",
          "resource": "summary-a",
          "recipient": "triage@north.training.test",
          "body": "IR-042 / geprüftes synthetisches Lagebild",
          "approval": "approval-17"
        },
        "decision": "ALLOW",
        "executed": true,
        "reasons": [
          "Im aktuellen Modell nicht gesperrt."
        ],
        "effect": "SIMULIERTER Versand. Keine Nachricht wurde versendet."
      }
    },
    {
      "name": "Wiederverwendung wird gesperrt",
      "ok": true,
      "observation": {
        "proposal": {
          "actor": "lea",
          "tenant": "north",
          "caseId": "IR-042",
          "tool": "report.send",
          "resource": "summary-a",
          "recipient": "triage@north.training.test",
          "body": "IR-042 / geprüftes synthetisches Lagebild",
          "approval": "approval-17"
        },
        "decision": "DENY",
        "executed": false,
        "reasons": [
          "Freigabe bereits verbraucht."
        ],
        "effect": "Kein Seiteneffekt."
      }
    }
  ],
  "before": {
    "enforceActor": false,
    "enforceTenant": false,
    "enforceCase": false,
    "enforceTools": false,
    "enforceRecipients": false,
    "requireApproval": false,
    "bindApproval": false,
    "checkExpiry": false,
    "singleUse": false,
    "failClosed": false,
    "allowedTools": [
      "case.read",
      "report.draft",
      "report.send",
      "tenant.admin"
    ],
    "recipients": [
      "triage@north.training.test",
      "review@north.training.test",
      "collector@outside.training.test"
    ]
  },
  "after": {
    "enforceActor": true,
    "enforceTenant": true,
    "enforceCase": true,
    "enforceTools": true,
    "enforceRecipients": true,
    "requireApproval": true,
    "bindApproval": true,
    "checkExpiry": true,
    "singleUse": true,
    "failClosed": true,
    "allowedTools": [
      "case.read",
      "report.draft",
      "report.send"
    ],
    "recipients": [
      "triage@north.training.test",
      "review@north.training.test"
    ]
  }
}