{
  "context": "Tests whether the agent implements centralized authorization enforcement with structured denial logging that captures user identity, action, resource identifier (non-PII), and a rationale code for each denied request.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Denial log includes resource identifier",
      "description": "Each logged denial record includes a resource identifier (e.g. project_id, report_id) indicating which resource was the target of the denied action.",
      "max_score": 15
    },
    {
      "name": "Denial log includes rationale code",
      "description": "Each logged denial record includes a reason/rationale code or category (e.g. 'INSUFFICIENT_ROLE', 'NOT_OWNER', 'MISSING_SCOPE') — not just a generic 'forbidden' message.",
      "max_score": 20
    },
    {
      "name": "Centralized authorization enforcement",
      "description": "Authorization checks and denial logging are implemented in a single shared middleware, decorator, or policy function — NOT duplicated independently in each route handler.",
      "max_score": 20
    },
    {
      "name": "Deny-by-default structure",
      "description": "The authorization middleware/decorator defaults to denying access — permission must be explicitly granted rather than explicitly blocked.",
      "max_score": 5
    },
    {
      "name": "Generic error response",
      "description": "When access is denied, the HTTP response does NOT reveal whether the resource exists — returns 403 or a uniform 404 rather than a message that distinguishes 'not found' from 'forbidden'.",
      "max_score": 20
    },
    {
      "name": "Logging does not include PII in log record",
      "description": "The denial log record does NOT contain PII fields such as user email, full name, or IP address as primary identifiers — uses non-PII user/resource IDs instead.",
      "max_score": 10
    },
    {
      "name": "Authorization pattern named",
      "description": "security_notes.md or code comments name the authorization pattern applied (e.g. ownership-based, RBAC, tenancy scoping) — not just describing what the code does.",
      "max_score": 10
    }
  ]
}