{
  "grants": [
    {
      "grant": {
        "schema": "cain42.e14.capability-grant.v1",
        "grant_id": "grant_159c4310dff01a0cddaf2fc9",
        "issuer": "principal:org-acme",
        "subject_agent": "agent-fin",
        "tenant": "tenant-a",
        "capability_id": "cap:ed104a4d9965c1d8112fd22948e3be3bd237d24547af1bcb0376a215c2ec3286",
        "capability_manifest_digest": "be64cb3c8d5f3830ab2b7765c647804df0c7a3530403aec36b7b06e704a7ba24",
        "scope": [
          [
            "CALL_MCP_TOOL",
            "tool:kv.get"
          ]
        ],
        "trajectory_id": "traj-1",
        "task_id": "",
        "policy_digest": "pol-1",
        "authority_digest": "bc988ea736a799e789014dc68caa5e19ea9eb6707244e8f7b8c4d9144bd25de3",
        "provenance_digest": "55e5702098e0a93dd14823e5c1e28120538f54f2c5e2f1c46f8130e2a0d77702",
        "issued_at": 1000.0,
        "expires_at": 1600.0,
        "max_invocations": 3,
        "max_financial": 0.0,
        "risk_ceiling": 0.5,
        "parent_grant_id": "",
        "delegation_depth": 0,
        "digest": "d7fa3f8fcf9763263b31ec267b2174d441473181e944ffe9337ece76302ef7b6",
        "issuer_public_key_b64": "vc3VI5CksYVoSBpreKIDWCUg5pez1VTgIBVWqnRQzIg=",
        "signature_b64": "6Aa19NGuygbwRJZyTB3Y9kLFB1Pl3Uuucbh0XogGJo4ioeugFZ8H8XHl1dPi0acMuLt+cn2ycEC4PDvgmjkwDg==",
        "authority": "NONE"
      },
      "issuer_authority": [
        [
          "CALL_MCP_TOOL",
          "tool:kv.get"
        ],
        [
          "READ_DATA",
          "db"
        ]
      ]
    },
    {
      "grant": {
        "schema": "cain42.e14.capability-grant.v1",
        "grant_id": "grant_c42a2a1848de143b94b504e6",
        "issuer": "agent:agent-fin",
        "subject_agent": "agent-fin-sub",
        "tenant": "tenant-a",
        "capability_id": "cap:ed104a4d9965c1d8112fd22948e3be3bd237d24547af1bcb0376a215c2ec3286",
        "capability_manifest_digest": "be64cb3c8d5f3830ab2b7765c647804df0c7a3530403aec36b7b06e704a7ba24",
        "scope": [
          [
            "CALL_MCP_TOOL",
            "tool:kv.get"
          ]
        ],
        "trajectory_id": "traj-1",
        "task_id": "",
        "policy_digest": "pol-1",
        "authority_digest": "98893e7d6bb88c21175e3656caa0f0a8b5215ef563c1799c326fca92491b66b1",
        "provenance_digest": "55e5702098e0a93dd14823e5c1e28120538f54f2c5e2f1c46f8130e2a0d77702",
        "issued_at": 1000.0,
        "expires_at": 1060.0,
        "max_invocations": 1,
        "max_financial": 0.0,
        "risk_ceiling": 0.5,
        "parent_grant_id": "grant_159c4310dff01a0cddaf2fc9",
        "delegation_depth": 1,
        "digest": "733f6afb039715222bbb79eaa96aa684c9e163aecad0570b41ea560c41fb94df",
        "issuer_public_key_b64": "vc3VI5CksYVoSBpreKIDWCUg5pez1VTgIBVWqnRQzIg=",
        "signature_b64": "hpJKbGfetzTxYwoFrtP/yuKKHnIUglbpoT45JwsfDjwNC/xr29J7YfX7SD0iv3x1OeSlv79ib96QdrNk4H//Aw==",
        "authority": "NONE"
      },
      "issuer_authority": [
        [
          "CALL_MCP_TOOL",
          "tool:kv.get"
        ]
      ]
    }
  ],
  "refused": [
    {
      "scenario": "grant exceeds issuer authority",
      "granted": false,
      "reason": "GRANT_EXCEEDS_ISSUER_AUTHORITY:CALL_MCP_TOOL:tool:kv.get"
    },
    {
      "scenario": "subagent exceeds parent",
      "granted": false,
      "reason": "CHILD_EXCEEDS_PARENT_CAPABILITY:PAYMENT:a"
    },
    {
      "scenario": "cross-tenant grant",
      "granted": false,
      "reason": "CROSS_TENANT_CAPABILITY"
    }
  ]
}