{
  "bounded_objective": "Only owner or named collaborator can retrieve document content; unauthenticated callers cannot retrieve metadata.",
  "required_negative_paths": [
    "unrelated_authenticated document read denied",
    "unauthenticated metadata read denied"
  ],
  "forbidden_conclusions": [
    "A threat model proves the system is secure.",
    "A generic security checklist is a complete threat model.",
    "One green path proves production authorization.",
    "Moving a component across a trust boundary leaves the old threat model automatically valid."
  ],
  "transfer_context": "Synthetic appointment-sharing feature with different actors and data sensitivity."
}