{
  "tool_id": "art-651-authzen-conformance-fixture",
  "tool_version": "1.0.0",
  "display_name": "Authzen Conformance Fixture",
  "mcp_name": "compute_authzen_conformance_fixture",
  "mandate_type": "compliance_control",
  "wave": 104,
  "gpu": false,
  "url": "https://ainumbers.co/chaingraph/art-651-authzen-conformance-fixture.html",
  "description": "Evaluates the 8-decision AuthZEN Authorization API 1.0 certification fixture (AUTHZEN-CONFORMANCE-BUILD-SPEC.md) through the spec-mandated subject/action/resource/context request envelope (Information Model §5, Access Evaluation API §6.1-6.2), against a local hand-authored FIXTURE_POLICY. AuthZEN is an OpenID Foundation open specification rather than a regulation or legal instrument , standards_basis is implements_standard against a published spec, per SO #38 Step 0. The spec itself is silent on PDP decision logic (§2: 'policy language... beyond the scope of this specification'), so the 8 decision outcomes are mechanical, hand-authored test-fixture policy (role/resource-state/action-parameter rules), not spec-mandated content; what IS spec-mandated and cited below is the request/response envelope shape and the boolean-only Decision semantics the fixture is expressed through. Also checks the §6.1 'context is OPTIONAL and must not change the decision' invariant on every decision.",
  "input_schema_ref": "chaingraph/art-651-authzen-conformance-fixture.html#manifest",
  "consumes": [],
  "feeds": [],
  "status": "live",
  "conformance_fixtures": true,
  "compute_capability": "server",
  "compute_images": [
    {
      "system": "sha256-source",
      "image_id": "sha256:a5c7470c83caad488c64b75342a1e532d18fc9c76126d3c5cb0614deb36bc15d",
      "valid_from": "2026-08-17"
    },
    {
      "system": "risc0",
      "image_id": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
      "valid_from": "2026-08-21"
    }
  ],
  "export_capability": [
    "json"
  ],
  "standards_basis": "implements_standard",
  "cited_clause_source": [
    "https://openid.net/specs/authorization-api-1_0.html"
  ],
  "cited_clause_digest": [
    {
      "digest": "sha256:991ba7b4a7f70912be3d1c0e8bb6b97c78d499a5a61d1792d701e3464cfd71e5",
      "source_url": "https://openid.net/specs/authorization-api-1_0.html",
      "retrieved_at": "2026-08-17",
      "clause_path": "§5.1",
      "scheme": "openid-authzen",
      "id": "AuthZEN Authorization API 1.0 §5.1 Subject"
    },
    {
      "digest": "sha256:da42892b2aa6058c7c7def220fe3fc7f5446c0a58987b6b8ce83fd2927f24def",
      "source_url": "https://openid.net/specs/authorization-api-1_0.html",
      "retrieved_at": "2026-08-17",
      "clause_path": "§5.2",
      "scheme": "openid-authzen",
      "id": "AuthZEN Authorization API 1.0 §5.2 Resource"
    },
    {
      "digest": "sha256:0838327bbb8c444c1557b7dd2e50879de9f9d4653aab4a8b5b895073ad214900",
      "source_url": "https://openid.net/specs/authorization-api-1_0.html",
      "retrieved_at": "2026-08-17",
      "clause_path": "§5.3",
      "scheme": "openid-authzen",
      "id": "AuthZEN Authorization API 1.0 §5.3 Action"
    },
    {
      "digest": "sha256:6bc2daccdfa1d2d749a9cb5104be41c9b1f91219b9a2484e806c069b3581aa56",
      "source_url": "https://openid.net/specs/authorization-api-1_0.html",
      "retrieved_at": "2026-08-17",
      "clause_path": "§5.5",
      "scheme": "openid-authzen",
      "id": "AuthZEN Authorization API 1.0 §5.5 Decision"
    },
    {
      "digest": "sha256:475fcdade4fa8161e3c8c179f2d281a365bee9f54a6c3f6acc4af15c54f1bccd",
      "source_url": "https://openid.net/specs/authorization-api-1_0.html",
      "retrieved_at": "2026-08-17",
      "clause_path": "§6.1",
      "scheme": "openid-authzen",
      "id": "AuthZEN Authorization API 1.0 §6.1 Access Evaluation API Request"
    },
    {
      "digest": "sha256:a4f3cf709c9aded4aa6103d75e9a4dbd0ae956c9551fe9a0a5b066088d04fd0a",
      "source_url": "https://openid.net/specs/authorization-api-1_0.html",
      "retrieved_at": "2026-08-17",
      "clause_path": "§6.2",
      "scheme": "openid-authzen",
      "id": "AuthZEN Authorization API 1.0 §6.2 Access Evaluation API Response"
    }
  ],
  "clause_retrieved_date": "2026-08-17",
  "clause_snapshot_location": "research/clause-snapshots/authzen-authorization-api-1.0.md; research/clause-snapshots/authzen-spec.html (whole-document context copy); research/clause-snapshots/authzen-excerpts/authzen-5.1-subject.txt; authzen-5.2-resource.txt; authzen-5.3-action.txt; authzen-5.5-decision.txt; authzen-6.1-request.txt; authzen-6.2-response.txt (the 6 excerpts registered in chaingraph/standard/clause-snapshot-registry.json, one per cited_clause_digest entry)",
  "cited_clause_paragraphs": [
    "§5.1 Subject: \"A Subject is an object that contains two REQUIRED keys, type and id... and an OPTIONAL key, properties\" — the subject shape every fixture request uses.",
    "§5.2 Resource: constructed like a Subject (REQUIRED type/id, OPTIONAL properties) — the resource shape every fixture request uses, including the owner/status properties FIXTURE_POLICY reads.",
    "§5.3 Action: \"Action is an object that contains a REQUIRED name key... and an OPTIONAL properties key\" — the action shape, including the delete.properties.soft parameter FIXTURE_POLICY reads.",
    "§5.5 Decision: \"a REQUIRED decision key with a boolean value\"... \"there are only two possible values for the decision: true... false: ...MUST NOT be permitted to go forward\" — the decision output shape and boolean-only semantics compute() returns.",
    "§6.1 Access Evaluation API Request: \"subject: REQUIRED... action: REQUIRED... resource: REQUIRED... context: OPTIONAL\" — the four-entity envelope, and the basis for the context-optional invariant this kernel checks on every decision.",
    "§6.2 Access Evaluation API Response: \"The response... consists of the Decision entity\" — confirms the response shape compute() reports per request."
  ],
  "scope_statement": "The Decision VALUE for each of the 8 fixture requests (whether alice/bob may read/write/delete a given record) is local hand-authored test policy rather than spec-mandated content , AuthZEN §2 explicitly places PDP policy logic out of scope ('The policy language, architecture, and state management aspects of a PDP are beyond the scope of this specification'). What is cited above and exercised by compute() is the request/response ENVELOPE (§5 Subject/Action/Resource, §6.1 request shape with OPTIONAL context, §6.2 response-is-a-Decision, §5.5 boolean-only decision semantics) and the §6.1 context-optional invariant, checked on every decision. CLAUSE-SILENT determination (SO #39(b)(ii), art-617 precedent): the fixture-policy rule table is a design choice named explicitly here, not an omission, and needs no further authority because it is not asserted as spec-mandated.",
  "compute_proof_ready": "ready",
  "compute_proof": {
    "type": "ZkVmReceipt",
    "system": "risc0",
    "receiptFormat": "groth16-bn254",
    "imageId": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
    "seal": "CQLl0GYMNRhiQYQKKBExbeLrPU81vt23FcHNSvyOVI8ffsIdKZR8YgZQLLcPcro0GGaGZrA5UcixqlQ2IV5Mni310d5Ra4d+mGl1sTdYXkx7FAuMLPpkmMGfT8f8oOQBAIj9422TRLUM/AUkraCY237DhE114y7AKzwjJNKdupkW/91MhwEjeEcvB1FcById4XxglRcjGXP+Tq4FDdZn5SAwRjZ0TIfcCC7GhhNfcck3UldLtUH2MB4/I6hB+GyVHsDgSdn4wqnziUELk8hLG94kjcRbvCTsuE07IOdYUAYqDP/jY7hDLtMOugR4SSMUYPsPDzKnTf3+ZV9jkSbo1A==",
    "journal": {
      "chaingraph_version": "0.4.0",
      "kernel_digest": "sha256:a5c7470c83caad488c64b75342a1e532d18fc9c76126d3c5cb0614deb36bc15d",
      "output": {
        "all_context_invariant": true,
        "all_match_expected": true,
        "decision_count": 8,
        "decisions": [
          {
            "action": {
              "name": "read"
            },
            "context_invariant": true,
            "decision": true,
            "expected": true,
            "index": 0,
            "matches_expected": true,
            "name": "alice-read-record1",
            "resource": {
              "id": "record-1",
              "properties": {
                "owner": "alice",
                "status": "active"
              },
              "type": "record"
            },
            "subject": {
              "id": "alice",
              "type": "user"
            }
          },
          {
            "action": {
              "name": "write"
            },
            "context_invariant": true,
            "decision": true,
            "expected": true,
            "index": 1,
            "matches_expected": true,
            "name": "alice-write-record1-active",
            "resource": {
              "id": "record-1",
              "properties": {
                "owner": "alice",
                "status": "active"
              },
              "type": "record"
            },
            "subject": {
              "id": "alice",
              "type": "user"
            }
          },
          {
            "action": {
              "name": "read"
            },
            "context_invariant": true,
            "decision": true,
            "expected": true,
            "index": 2,
            "matches_expected": true,
            "name": "bob-read-record1",
            "resource": {
              "id": "record-1",
              "properties": {
                "owner": "alice",
                "status": "active"
              },
              "type": "record"
            },
            "subject": {
              "id": "bob",
              "type": "user"
            }
          },
          {
            "action": {
              "name": "write"
            },
            "context_invariant": true,
            "decision": false,
            "expected": false,
            "index": 3,
            "matches_expected": true,
            "name": "bob-write-record1-active",
            "resource": {
              "id": "record-1",
              "properties": {
                "owner": "alice",
                "status": "active"
              },
              "type": "record"
            },
            "subject": {
              "id": "bob",
              "type": "user"
            }
          },
          {
            "action": {
              "name": "write"
            },
            "context_invariant": true,
            "decision": false,
            "expected": false,
            "index": 4,
            "matches_expected": true,
            "name": "alice-write-record2-archived",
            "resource": {
              "id": "record-2",
              "properties": {
                "owner": "alice",
                "status": "archived"
              },
              "type": "record"
            },
            "subject": {
              "id": "alice",
              "type": "user"
            }
          },
          {
            "action": {
              "name": "write"
            },
            "context_invariant": true,
            "decision": true,
            "expected": true,
            "index": 5,
            "matches_expected": true,
            "name": "bob-admin-write-record2-archived",
            "resource": {
              "id": "record-2",
              "properties": {
                "owner": "alice",
                "status": "archived"
              },
              "type": "record"
            },
            "subject": {
              "id": "bob",
              "properties": {
                "role": "admin"
              },
              "type": "user"
            }
          },
          {
            "action": {
              "name": "delete",
              "properties": {
                "soft": true
              }
            },
            "context_invariant": true,
            "decision": true,
            "expected": true,
            "index": 6,
            "matches_expected": true,
            "name": "alice-delete-soft-record1",
            "resource": {
              "id": "record-1",
              "properties": {
                "owner": "alice",
                "status": "active"
              },
              "type": "record"
            },
            "subject": {
              "id": "alice",
              "type": "user"
            }
          },
          {
            "action": {
              "name": "delete",
              "properties": {
                "soft": false
              }
            },
            "context_invariant": true,
            "decision": false,
            "expected": false,
            "index": 7,
            "matches_expected": true,
            "name": "alice-delete-hard-record1",
            "resource": {
              "id": "record-1",
              "properties": {
                "owner": "alice",
                "status": "active"
              },
              "type": "record"
            },
            "subject": {
              "id": "alice",
              "type": "user"
            }
          }
        ],
        "spec": "AuthZEN Authorization API 1.0 (OpenID Foundation Final Specification)"
      }
    }
  }
}