{
 "product": "Data-Exfiltration Killswitch",
 "slug": "exfil-killswitch",
 "base": "https://cainstudio.online",
 "page": "https://cainstudio.online/guide-exfil-killswitch.html",
 "claims": [
  {
   "id": "C01",
   "kind": "control",
   "claim": "1 MB export at 3 a.m. -> Under the off-hours limit: allowed.",
   "requests": [
    {
     "method": "POST",
     "url": "/api/v1/mcpgate/killswitch/simulate-exfiltration",
     "body": {
      "volume_bytes": 1048576,
      "simulated_time_iso": "2026-11-03T03:00:00Z"
     }
    }
   ],
   "path": "killswitch_tripped",
   "expect": [
    false
   ]
  },
  {
   "id": "C02",
   "kind": "control",
   "claim": "4 MB export at 3 a.m. -> Still under 5 MB: allowed.",
   "requests": [
    {
     "method": "POST",
     "url": "/api/v1/mcpgate/killswitch/simulate-exfiltration",
     "body": {
      "volume_bytes": 4194304,
      "simulated_time_iso": "2026-11-03T03:00:00Z"
     }
    }
   ],
   "path": "killswitch_tripped",
   "expect": [
    false
   ]
  },
  {
   "id": "C03",
   "kind": "control",
   "claim": "10 MB export at 2 p.m. -> Daytime, under the 50 MB burst limit: allowed.",
   "requests": [
    {
     "method": "POST",
     "url": "/api/v1/mcpgate/killswitch/simulate-exfiltration",
     "body": {
      "volume_bytes": 10485760,
      "simulated_time_iso": "2026-11-03T14:00:00Z"
     }
    }
   ],
   "path": "killswitch_tripped",
   "expect": [
    false
   ]
  },
  {
   "id": "C04",
   "kind": "attack",
   "claim": "10 MB export at 3 a.m. -> Off-hours bulk export: tripped.",
   "requests": [
    {
     "method": "POST",
     "url": "/api/v1/mcpgate/killswitch/simulate-exfiltration",
     "body": {
      "volume_bytes": 10485760,
      "simulated_time_iso": "2026-11-03T03:00:00Z"
     }
    }
   ],
   "path": "killswitch_tripped",
   "expect": [
    true
   ]
  },
  {
   "id": "C05",
   "kind": "attack",
   "claim": "50 MB bulk export at 3 a.m. -> The classic overnight data grab: tripped.",
   "requests": [
    {
     "method": "POST",
     "url": "/api/v1/mcpgate/killswitch/simulate-exfiltration",
     "body": {
      "volume_bytes": 52428800,
      "simulated_time_iso": "2026-11-03T03:00:00Z"
     }
    }
   ],
   "path": "killswitch_tripped",
   "expect": [
    true
   ]
  },
  {
   "id": "C06",
   "kind": "attack",
   "claim": "60 MB burst in the afternoon -> Over the single-burst limit at any hour: tripped.",
   "requests": [
    {
     "method": "POST",
     "url": "/api/v1/mcpgate/killswitch/simulate-exfiltration",
     "body": {
      "volume_bytes": 62914560,
      "simulated_time_iso": "2026-11-03T14:00:00Z"
     }
    }
   ],
   "path": "killswitch_tripped",
   "expect": [
    true
   ]
  }
 ]
}