{
  "bounded_objective": "Same-workspace subjects receive only task-required actions; all unmatched or cross-workspace requests are denied at the server policy evaluator.",
  "required_positive_paths": [
    "Viewer same-workspace file.read allowed",
    "Editor same-workspace file.write allowed",
    "WorkspaceAdmin same-workspace member.manage allowed"
  ],
  "required_negative_paths": [
    "unknown action denied",
    "cross-workspace read denied",
    "Editor member.manage denied"
  ],
  "forbidden_conclusions": [
    "Authentication success implies authorization for every resource.",
    "UI visibility is an authorization control.",
    "RBAC is always the best model for every authorization problem.",
    "A single admin role should accumulate all privileged actions for convenience."
  ],
  "transfer_context": "Synthetic support system with Agent, Supervisor and Billing roles over tenant-scoped tickets; role alone may be insufficient when tenant/assignment relationships matter."
}