{
  "schemaVersion": "ga-authorization-scope-binding-preflight-v1.0",
  "sourceSchemas": {
    "authorizationValidity": "ga-authorization-validity-window-preflight-v1.0",
    "authorizationProvenance": "ga-authorization-provenance-preflight-v1.0",
    "separationOfDuties": "ga-separation-of-duties-matrix-v1.0",
    "externalEffectDenial": "ga-external-effect-denial-matrix-v1.0"
  },
  "mode": "deterministic_authorization_scope_binding_preflight_only",
  "generatedAt": "2026-08-03T09:06:00-06:00",
  "status": "blocked_no_active_scope_bound_authorization",
  "targetRing": "controlled_ga",
  "prerequisiteSnapshot": {
    "activeAuthorizations": 0,
    "effectiveAuthorizations": 0,
    "signedProvenanceLinks": 0,
    "completedProvenanceStages": 0,
    "assignedDuties": 0,
    "satisfiedSeparationConstraints": 0,
    "executedExternalEffects": 0
  },
  "bindingId": null,
  "immutableScopeSnapshotRef": null,
  "bindingDigest": null,
  "fields": [
    {
      "id": "authorization_ref",
      "order": 1,
      "label": "Active authorization reference",
      "required": true,
      "value": null
    },
    {
      "id": "scope_digest",
      "order": 2,
      "label": "Immutable authorized scope digest",
      "required": true,
      "value": null
    },
    {
      "id": "audience_digest",
      "order": 3,
      "label": "Immutable authorized audience digest",
      "required": true,
      "value": null
    },
    {
      "id": "authorized_ring",
      "order": 4,
      "label": "Authorized deployment ring",
      "required": true,
      "value": null
    },
    {
      "id": "permitted_effect_type",
      "order": 5,
      "label": "Single permitted external-effect type",
      "required": true,
      "value": null
    },
    {
      "id": "resource_ref",
      "order": 6,
      "label": "Exact governed resource reference",
      "required": true,
      "value": null
    },
    {
      "id": "change_ticket_ref",
      "order": 7,
      "label": "Bound change ticket reference",
      "required": true,
      "value": null
    },
    {
      "id": "executor_identity_ref",
      "order": 8,
      "label": "Independently verified executor identity",
      "required": true,
      "value": null
    },
    {
      "id": "max_executions",
      "order": 9,
      "label": "Maximum authorized execution count",
      "required": true,
      "value": null
    },
    {
      "id": "policy_ref",
      "order": 10,
      "label": "Scope-binding and replay policy reference",
      "required": true,
      "value": null
    }
  ],
  "checks": [
    {
      "id": "binding-authorization-active",
      "order": 1,
      "type": "authorization_active",
      "label": "Authorization is active and currently effective",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-provenance",
      "order": 2,
      "type": "provenance_bound",
      "label": "Signed immutable authorization provenance is bound",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-scope",
      "order": 3,
      "type": "scope_exact",
      "label": "Exact scope digest matches the authorized candidate",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-audience",
      "order": 4,
      "type": "audience_exact",
      "label": "Audience and ring digests match the authorization",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-effect",
      "order": 5,
      "type": "effect_allowed",
      "label": "Exactly one external-effect class is permitted",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-executor",
      "order": 6,
      "type": "executor_separated",
      "label": "Executor identity is independently verified and separated",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-ticket",
      "order": 7,
      "type": "change_ticket_bound",
      "label": "Change ticket is immutable and bound to the same scope",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    },
    {
      "id": "binding-single-use",
      "order": 8,
      "type": "single_use_limit",
      "label": "Maximum execution count is explicitly one",
      "status": "not_evaluated",
      "satisfied": false,
      "evidenceRef": null,
      "evaluatedBy": null,
      "evaluatedAt": null
    }
  ],
  "lifecycle": {
    "scopeBound": false,
    "audienceBound": false,
    "effectBound": false,
    "executorBound": false,
    "ticketBound": false,
    "bindingEffective": false
  },
  "prohibitedClaims": [
    "authorization_reference_as_scope_binding",
    "broad_scope_as_least_privilege",
    "ci_success_as_binding_evidence",
    "draft_pr_as_effect_authority"
  ],
  "summary": {
    "requiredFields": 10,
    "completedFields": 0,
    "checks": 8,
    "evaluatedChecks": 0,
    "satisfiedChecks": 0,
    "effectiveBindings": 0,
    "boundScopes": 0,
    "boundAudiences": 0,
    "boundEffects": 0,
    "boundExecutors": 0,
    "boundTickets": 0
  },
  "nextHumanAction": {
    "action": "After an active time-bound authorization exists, bind one immutable scope, audience, effect type, resource, change ticket and independently verified executor before any consumption can be considered.",
    "executed": false
  },
  "recommendation": {
    "value": "do_not_bind_or_execute",
    "reasonCodes": [
      "active_authorization_absent",
      "scope_binding_fields_blank",
      "scope_binding_checks_not_evaluated",
      "executor_identity_absent",
      "change_ticket_absent"
    ],
    "canOverrideHumanDecision": false
  },
  "authority": {
    "bindingIdRecordingAllowed": false,
    "immutableScopeSnapshotBindingAllowed": false,
    "bindingDigestRecordingAllowed": false,
    "fieldMutationAllowed": false,
    "checkEvaluationAllowed": false,
    "evidenceLinkingAllowed": false,
    "scopeBindingAllowed": false,
    "audienceBindingAllowed": false,
    "effectBindingAllowed": false,
    "resourceBindingAllowed": false,
    "changeTicketBindingAllowed": false,
    "executorBindingAllowed": false,
    "maxExecutionSettingAllowed": false,
    "policyBindingAllowed": false,
    "bindingActivationAllowed": false,
    "authorizationConsumptionAllowed": false,
    "executionEventRecordingAllowed": false,
    "transitionExecutionAllowed": false,
    "rollbackExecutionAllowed": false,
    "audienceOrCustomerActivationAllowed": false,
    "communicationDispatchAllowed": false,
    "billingConnectorOrCustomerDataMutationAllowed": false,
    "productionMutationAllowed": false,
    "readyForReviewAllowed": false,
    "mergeAllowed": false,
    "deploymentAllowed": false,
    "productionReleaseAllowed": false,
    "externalEffect": false,
    "exactScopeBindingRequired": true,
    "singleEffectAuthorizationRequired": true,
    "immutableScopeSnapshotRequired": true
  }
}