A permission should be an exact action, not a blank check.

{
  "title": "Purpose-Bound Action Grants evaluator test vectors",
  "version": "1.1",
  "publishedAt": "2026-07-23T00:00:00.000Z",
  "modifiedAt": "2026-08-05T00:00:00.000Z",
  "scope": "Deterministic vectors for the browser-local educational evaluator; not a production security test or compliance artifact.",
  "vectors": [
    {
      "id": "missing-grant",
      "grantState": "unapproved",
      "attempt": "exact",
      "expected": {
        "verdict": "denied",
        "code": "approval_required",
        "title": "Denied before any external effect",
        "detail": "No purpose-bound grant exists for this action.",
        "consumesGrant": false
      }
    },
    {
      "id": "exact-active-grant",
      "grantState": "active",
      "attempt": "exact",
      "expected": {
        "verdict": "allowed",
        "code": "exact_grant_consumed",
        "title": "Allowed exactly once",
        "detail": "The action matches the approved snapshot. The grant is atomically consumed before the simulated effect.",
        "consumesGrant": true
      }
    },
    {
      "id": "replayed-grant",
      "grantState": "consumed",
      "attempt": "exact",
      "expected": {
        "verdict": "denied",
        "code": "grant_already_consumed",
        "title": "Replay denied",
        "detail": "The single-use grant was already consumed. A later attempt needs fresh authority.",
        "consumesGrant": false
      }
    },
    {
      "id": "changed-payload",
      "grantState": "active",
      "attempt": "changed",
      "expected": {
        "verdict": "denied",
        "code": "approval_content_changed",
        "title": "Changed content needs fresh review",
        "detail": "The recipient and subject no longer match the action snapshot that was approved.",
        "consumesGrant": false
      }
    },
    {
      "id": "different-tool",
      "grantState": "active",
      "attempt": "wrong_tool",
      "expected": {
        "verdict": "denied",
        "code": "grant_scope_mismatch",
        "title": "Different tool denied",
        "detail": "Authority for Gmail send_email cannot be reused for drive.create_file.",
        "consumesGrant": false
      }
    },
    {
      "id": "expired-grant",
      "grantState": "active",
      "attempt": "expired",
      "expected": {
        "verdict": "denied",
        "code": "grant_expired",
        "title": "Expired authority denied",
        "detail": "The grant's short approval window ended before the external boundary.",
        "consumesGrant": false
      }
    }
  ]
}