{
  "tool_id": "art-523-identity-proofing-assurance-level",
  "note": "golden_hash filled by golden-parity.test.mjs --update. Vector 1: framework A (tiered) -- declared evidence meets the target level cleanly. Vector 2: framework B (structurally different -- named bands, a criterion missing min_strength) -- target level not met, one criterion is undecidable (definition cannot express it) distinct from the one criterion that is a genuine shortfall, achieved level falls back to the highest fully-met band below target. Vector 3: zero-input edge (finite gate) -- no level_definition, no evidence, both IAL_DEFINITION_INSUFFICIENT and IAL_EVIDENCE_UNDECLARED fire and neither IAL_MET nor IAL_SHORTFALL is asserted.",
  "vectors": [
    {
      "name": "framework_a_tiers_met",
      "description": "A tiered framework (tier-1/tier-2/tier-3) expressed on the shared input shape; declared evidence meets target level tier-2 cleanly.",
      "policy_parameters": {
        "level_definition": {
          "framework_id": "vendor-framework-A-tiers",
          "framework_version": "2026-01",
          "levels": [
            {
              "level_id": "tier-1",
              "criteria": [
                {
                  "criterion_id": "id-doc",
                  "description": "one identity document",
                  "required_evidence_type": "government_id",
                  "min_strength": 30
                }
              ]
            },
            {
              "level_id": "tier-2",
              "criteria": [
                {
                  "criterion_id": "id-doc",
                  "description": "verified identity document",
                  "required_evidence_type": "government_id",
                  "min_strength": 60
                },
                {
                  "criterion_id": "biometric",
                  "description": "biometric match",
                  "required_evidence_type": "biometric_match",
                  "min_strength": 60
                }
              ]
            },
            {
              "level_id": "tier-3",
              "criteria": [
                {
                  "criterion_id": "id-doc",
                  "description": "verified identity document, high assurance",
                  "required_evidence_type": "government_id",
                  "min_strength": 85
                },
                {
                  "criterion_id": "biometric",
                  "description": "biometric match, high assurance",
                  "required_evidence_type": "biometric_match",
                  "min_strength": 85
                }
              ]
            }
          ]
        },
        "evidence_items": [
          {
            "evidence_id": "e1",
            "type": "government_id",
            "strength": 70,
            "verification_method": "document_authentication"
          },
          {
            "evidence_id": "e2",
            "type": "biometric_match",
            "strength": 65,
            "verification_method": "live_capture"
          }
        ],
        "declared_target_level": "tier-2",
        "as_of": "2026-08-01"
      },
      "output_payload": {
        "framework_id": "vendor-framework-A-tiers",
        "framework_version": "2026-01",
        "declared_target_level": "tier-2",
        "as_of": "2026-08-01",
        "levels_defined": 3,
        "target_level_found": true,
        "evidence_item_count": 2,
        "criteria_evaluated": 2,
        "criteria_met": 2,
        "criteria_shortfall_count": 0,
        "criteria_undecidable_count": 0,
        "achieved_level": "tier-2",
        "target_met": true,
        "shortfall": [],
        "undecidable": [],
        "note": "Rates a DECLARED evidence set against a caller-supplied, versioned assurance-level framework -- never a hardcoded one. Does not assert a person is who they claim to be: this evidences that a declared evidence set was measured against a declared policy, not the truth of the declarations. A criterion the definition cannot express (no required_evidence_type or no min_strength) is reported as IAL_DEFINITION_INSUFFICIENT, distinct from IAL_SHORTFALL (evidence present but not meeting a well-formed criterion) -- the two are never conflated. No identity attributes are ever computed over; evidence items are types, strengths and verification methods, with an optional opaque attribute reference (caller-supplied, no commitment scheme claimed by this node) carried through unread."
      },
      "compliance_flags": [
        "IAL_MET"
      ],
      "golden_hash": "0bf034738dd4d1c23114c68e84fa75d9d5e0622b3d2cc748bce5d8f56d10ddb5"
    },
    {
      "name": "framework_b_bands_shortfall_and_undecidable",
      "description": "A structurally different framework (named bands, not tiers) on the same input shape; the top band has one genuine shortfall and one criterion the definition cannot express (missing min_strength), so achieved level falls back to the highest fully-met band below target.",
      "policy_parameters": {
        "level_definition": {
          "framework_id": "vendor-framework-B-bands",
          "framework_version": "1.3",
          "levels": [
            {
              "level_id": "band-low",
              "criteria": [
                {
                  "criterion_id": "basic-id",
                  "description": "national ID card check",
                  "required_evidence_type": "national_id_card",
                  "min_strength": 20
                }
              ]
            },
            {
              "level_id": "band-medium",
              "criteria": [
                {
                  "criterion_id": "basic-id",
                  "description": "national ID card check",
                  "required_evidence_type": "national_id_card",
                  "min_strength": 50
                },
                {
                  "criterion_id": "address",
                  "description": "proof of address",
                  "required_evidence_type": "address_proof",
                  "min_strength": 40
                }
              ]
            },
            {
              "level_id": "band-high",
              "criteria": [
                {
                  "criterion_id": "basic-id",
                  "description": "national ID card check",
                  "required_evidence_type": "national_id_card",
                  "min_strength": 80
                },
                {
                  "criterion_id": "liveness",
                  "description": "liveness check",
                  "required_evidence_type": "liveness_check"
                }
              ]
            }
          ]
        },
        "evidence_items": [
          {
            "evidence_id": "f1",
            "type": "national_id_card",
            "strength": 55,
            "verification_method": "visual_inspection"
          },
          {
            "evidence_id": "f2",
            "type": "address_proof",
            "strength": 60
          }
        ],
        "declared_target_level": "band-high",
        "as_of": "2026-08-01"
      },
      "output_payload": {
        "framework_id": "vendor-framework-B-bands",
        "framework_version": "1.3",
        "declared_target_level": "band-high",
        "as_of": "2026-08-01",
        "levels_defined": 3,
        "target_level_found": true,
        "evidence_item_count": 2,
        "criteria_evaluated": 2,
        "criteria_met": 0,
        "criteria_shortfall_count": 1,
        "criteria_undecidable_count": 1,
        "achieved_level": "band-medium",
        "target_met": false,
        "shortfall": [
          {
            "level_id": "band-high",
            "criterion_id": "basic-id",
            "description": "national ID card check",
            "required_evidence_type": "national_id_card",
            "min_strength": 80,
            "reason": "best available evidence of type \"national_id_card\" has strength 55, below required 80"
          }
        ],
        "undecidable": [
          {
            "level_id": "band-high",
            "criterion_id": "liveness",
            "reason": "criterion has no min_strength -- the definition cannot express how strong the evidence must be"
          }
        ],
        "note": "Rates a DECLARED evidence set against a caller-supplied, versioned assurance-level framework -- never a hardcoded one. Does not assert a person is who they claim to be: this evidences that a declared evidence set was measured against a declared policy, not the truth of the declarations. A criterion the definition cannot express (no required_evidence_type or no min_strength) is reported as IAL_DEFINITION_INSUFFICIENT, distinct from IAL_SHORTFALL (evidence present but not meeting a well-formed criterion) -- the two are never conflated. No identity attributes are ever computed over; evidence items are types, strengths and verification methods, with an optional opaque attribute reference (caller-supplied, no commitment scheme claimed by this node) carried through unread."
      },
      "compliance_flags": [
        "IAL_DEFINITION_INSUFFICIENT",
        "IAL_SHORTFALL"
      ],
      "golden_hash": "cfd37c6fa8fbbfec7bfbb2697616cfc2c03f3fb25fe0a85d10b9f5c0579e01a9"
    },
    {
      "name": "zero_input_edge",
      "description": "Finite gate: no level_definition, no evidence, no declared target -- both IAL_DEFINITION_INSUFFICIENT and IAL_EVIDENCE_UNDECLARED fire; neither IAL_MET nor IAL_SHORTFALL is asserted because there is nothing decidable to judge.",
      "policy_parameters": {
        "level_definition": {},
        "evidence_items": [],
        "declared_target_level": null,
        "as_of": null
      },
      "output_payload": {
        "framework_id": null,
        "framework_version": null,
        "declared_target_level": null,
        "as_of": null,
        "levels_defined": 0,
        "target_level_found": false,
        "evidence_item_count": 0,
        "criteria_evaluated": 0,
        "criteria_met": 0,
        "criteria_shortfall_count": 0,
        "criteria_undecidable_count": 0,
        "achieved_level": null,
        "target_met": false,
        "shortfall": [],
        "undecidable": [],
        "note": "Rates a DECLARED evidence set against a caller-supplied, versioned assurance-level framework -- never a hardcoded one. Does not assert a person is who they claim to be: this evidences that a declared evidence set was measured against a declared policy, not the truth of the declarations. A criterion the definition cannot express (no required_evidence_type or no min_strength) is reported as IAL_DEFINITION_INSUFFICIENT, distinct from IAL_SHORTFALL (evidence present but not meeting a well-formed criterion) -- the two are never conflated. No identity attributes are ever computed over; evidence items are types, strengths and verification methods, with an optional opaque attribute reference (caller-supplied, no commitment scheme claimed by this node) carried through unread."
      },
      "compliance_flags": [
        "IAL_DEFINITION_INSUFFICIENT",
        "IAL_EVIDENCE_UNDECLARED"
      ],
      "golden_hash": "485269f5718bc713bba24229359ca5903b25d57c7fb8ec50d6685a50ba9af06c"
    }
  ]
}