{
  "context": "Tests whether the agent produces a formal authorization matrix in YAML/JSON format, writes automated tests that iterate the matrix and assert allow/deny results, and includes negative tests covering bypass attempts and role downgrades.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Matrix is YAML or JSON",
      "description": "The authorization matrix is written as a YAML or JSON file (not plain text, not markdown table only) — auth_matrix.yaml or auth_matrix.json exists",
      "max_score": 5
    },
    {
      "name": "Tests iterate the matrix",
      "description": "The test file loads or references the authorization matrix and generates test cases from it — rather than hard-coding individual test cases without referencing the matrix structure",
      "max_score": 30
    },
    {
      "name": "Deny-by-default reflected",
      "description": "The matrix or test code reflects a deny-by-default stance — e.g. unlisted combinations default to deny, or there is an explicit deny entry for non-granted actions",
      "max_score": 20
    },
    {
      "name": "Security notes present",
      "description": "security_notes.md exists and mentions the purpose of negative tests (e.g. bypass attempts, role downgrades, or missing scopes)",
      "max_score": 20
    },
    {
      "name": "Prefer ABAC/ReBAC noted",
      "description": "security_notes.md or comments in the test code mention ABAC, ReBAC, or attribute/relationship-based access control as a preferred approach over simple role checks for future extensibility",
      "max_score": 25
    }
  ]
}