{
  "schema": "https://schemas.twoaye.com/protected-resource/v1.json",
  "schemaVersion": "1.0",
  "note": "Grant verification vectors for a protected resource. An implementation conforms when it accepts every acceptance case and refuses every rejection case. Rejection cases are as normative as acceptance cases: a permissive verifier is not a conforming one. A rejection vector states why the grant must be refused, never the wording used while refusing - message text is not normative, and a verifier that reports which check failed is already outside the specification (CONFORMANCE.md section 7). These vectors are generated from the reference implementation. They prove that an implementation agrees with that one, not that it is correct; an independent implementation finding a disagreement is what they are published for.",
  "signature": "ES256 over the canonical UTF-8 bytes. Raw 64-byte R||S, Base64Url. A DER signature is valid and every conforming verifier rejects it.",
  "key": {
    "kty": "EC",
    "crv": "P-256",
    "alg": "ES256",
    "kid": "3byCuBza2tk8zDZz",
    "x": "_n81lD8_39P5Ll-R5Bt61NQglORXVVyp8o2h1yennXo",
    "y": "xdmEDuW35eAn4QJiJsFO8ZrsZUmjCbmGOw17c9bXHqI"
  },
  "vectors": [
    {
      "name": "valid",
      "outcome": "accept",
      "why": "A well-formed grant signed by a key in the published set.",
      "canonical": "{\u0022action_hash\u0022:\u00229F2C7A1B4D6E8F0A2C4E6081A3C5E7092B4D6F81A3C5E70921B3D5F7092A4C6E\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "action-hash-changed",
      "outcome": "reject",
      "why": "A material parameter changed after the grant was issued. The resource recomputes the hash from the parameters it will actually use.",
      "canonical": "{\u0022action_hash\u0022:\u00220000\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "amount-scale-normalised",
      "outcome": "reject",
      "why": "13800.00 was re-rendered as 13800. The same number, a different string, and a different hash - a verifier that parses and re-renders an amount refuses every legitimate request.",
      "canonical": "{\u0022action_hash\u0022:\u0022DD729D3E264EAAAB926930509397C5C6151397F14A0A7F1FC61714026A6B4784\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "agent-changed",
      "outcome": "reject",
      "why": "Presented by an agent the grant does not name.",
      "canonical": "{\u0022action_hash\u0022:\u00229F2C7A1B4D6E8F0A2C4E6081A3C5E7092B4D6F81A3C5E70921B3D5F7092A4C6E\u0022,\u0022agent_id\u0022:\u002200000000-0000-0000-0000-000000000000\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "intent-version-changed",
      "outcome": "reject",
      "why": "A later version of the same contract. The grant authorized the version it was evaluated against, and nothing else.",
      "canonical": "{\u0022action_hash\u0022:\u00229F2C7A1B4D6E8F0A2C4E6081A3C5E7092B4D6F81A3C5E70921B3D5F7092A4C6E\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00222\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "expiry-extended",
      "outcome": "reject",
      "why": "The expiry was moved. A resource that trusts the field without the signature accepts an indefinite grant.",
      "canonical": "{\u0022action_hash\u0022:\u00229F2C7A1B4D6E8F0A2C4E6081A3C5E7092B4D6F81A3C5E70921B3D5F7092A4C6E\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222027-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "tenant-changed",
      "outcome": "reject",
      "why": "Re-addressed to another tenant.",
      "canonical": "{\u0022action_hash\u0022:\u00229F2C7A1B4D6E8F0A2C4E6081A3C5E7092B4D6F81A3C5E70921B3D5F7092A4C6E\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002211111111-1111-1111-1111-111111111111\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002200000000-0000-0000-0000-000000000000\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    },
    {
      "name": "grant-id-changed",
      "outcome": "reject",
      "why": "A different grant identifier over the same parameters, which is how a spent grant is presented as a fresh one.",
      "canonical": "{\u0022action_hash\u0022:\u00229F2C7A1B4D6E8F0A2C4E6081A3C5E7092B4D6F81A3C5E70921B3D5F7092A4C6E\u0022,\u0022agent_id\u0022:\u002244444444-4444-4444-4444-444444444444\u0022,\u0022expires_at\u0022:\u00222026-09-24T10:42:00.000Z\u0022,\u0022grant_id\u0022:\u002200000000-0000-0000-0000-000000000000\u0022,\u0022intent_id\u0022:\u002233333333-3333-3333-3333-333333333333\u0022,\u0022intent_version\u0022:\u00221\u0022,\u0022single_use\u0022:\u0022true\u0022,\u0022tenant_id\u0022:\u002222222222-2222-2222-2222-222222222222\u0022}",
      "signature": "1SW4zbkndaYwQGBhfMQhHqRquXAEmy0L2KKtgUEQuiOjNmSNSk4A3srqqEfwqWe9AVddFzaGcXSxoD2bPjPTVQ",
      "signingKeyId": "3byCuBza2tk8zDZz"
    }
  ]
}