id	kind	claim	recorded_value	expected	http	ms	recorded_at
C01	control	Open a work file in /tmp -> Inside the policy.	"ALLOW"	["ALLOW"]	200	46	2026-11-03T22:54:22+00:00
C02	attack	Open /etc/shadow (system passwords) -> A protected system file.	"DENIED"	["DENIED"]	200	52	2026-11-03T22:54:23+00:00
C03	attack	Open /root/.ssh/id_rsa (a private key) -> Private keys are off limits.	"DENIED"	["DENIED"]	200	56	2026-11-03T22:54:23+00:00