{
 "product": "Capability Lease",
 "slug": "capability-lease",
 "base": "https://cainstudio.online",
 "page": "https://cainstudio.online/guide-capability-lease.html",
 "claims": [
  {
   "id": "C01",
   "kind": "control",
   "claim": "Delegate read only, $50 budget -> Smaller than the parent: granted.",
   "requests": [
    {
     "method": "POST",
     "url": "/fabric/caplease/issue",
     "body": {
      "tenant_id": "public-demo",
      "principal_id": "human:dana",
      "agent_id": "planner",
      "authorized_ceiling": "EXECUTE",
      "capabilities": [
       "read",
       "write"
      ],
      "ttl_seconds": 3600,
      "budget_cents": 10000
     }
    },
    {
     "method": "POST",
     "url": "/fabric/caplease/prepare-delegation",
     "body": {
      "parent_lease_id": "${0.lease_id}",
      "child_agent_id": "worker",
      "requested_ceiling": "EXECUTE",
      "requested_capabilities": [
       "read"
      ],
      "ttl_seconds": 600,
      "budget_cents": 5000
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    200
   ]
  },
  {
   "id": "C02",
   "kind": "control",
   "claim": "Delegate read + write, $50 budget -> Same permissions, smaller budget: granted.",
   "requests": [
    {
     "method": "POST",
     "url": "/fabric/caplease/issue",
     "body": {
      "tenant_id": "public-demo",
      "principal_id": "human:dana",
      "agent_id": "planner",
      "authorized_ceiling": "EXECUTE",
      "capabilities": [
       "read",
       "write"
      ],
      "ttl_seconds": 3600,
      "budget_cents": 10000
     }
    },
    {
     "method": "POST",
     "url": "/fabric/caplease/prepare-delegation",
     "body": {
      "parent_lease_id": "${0.lease_id}",
      "child_agent_id": "worker",
      "requested_ceiling": "EXECUTE",
      "requested_capabilities": [
       "read",
       "write"
      ],
      "ttl_seconds": 600,
      "budget_cents": 5000
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    200
   ]
  },
  {
   "id": "C03",
   "kind": "attack",
   "claim": "Child asks for wire_transfer -> The parent never had it: refused (HTTP 403).",
   "requests": [
    {
     "method": "POST",
     "url": "/fabric/caplease/issue",
     "body": {
      "tenant_id": "public-demo",
      "principal_id": "human:dana",
      "agent_id": "planner",
      "authorized_ceiling": "EXECUTE",
      "capabilities": [
       "read",
       "write"
      ],
      "ttl_seconds": 3600,
      "budget_cents": 10000
     }
    },
    {
     "method": "POST",
     "url": "/fabric/caplease/prepare-delegation",
     "body": {
      "parent_lease_id": "${0.lease_id}",
      "child_agent_id": "worker",
      "requested_ceiling": "EXECUTE",
      "requested_capabilities": [
       "read",
       "wire_transfer"
      ],
      "ttl_seconds": 600,
      "budget_cents": 5000
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    403
   ]
  },
  {
   "id": "C04",
   "kind": "attack",
   "claim": "Child asks for a $500 budget -> More than the parent's $100: refused.",
   "requests": [
    {
     "method": "POST",
     "url": "/fabric/caplease/issue",
     "body": {
      "tenant_id": "public-demo",
      "principal_id": "human:dana",
      "agent_id": "planner",
      "authorized_ceiling": "EXECUTE",
      "capabilities": [
       "read",
       "write"
      ],
      "ttl_seconds": 3600,
      "budget_cents": 10000
     }
    },
    {
     "method": "POST",
     "url": "/fabric/caplease/prepare-delegation",
     "body": {
      "parent_lease_id": "${0.lease_id}",
      "child_agent_id": "worker",
      "requested_ceiling": "EXECUTE",
      "requested_capabilities": [
       "read"
      ],
      "ttl_seconds": 600,
      "budget_cents": 50000
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    403
   ]
  }
 ]
}