{
  "context": "Tests whether the agent implements a proper step-up authorization flow for a sensitive financial action, including time-limited unique credentials per transaction, What-You-See-Is-What-You-Sign confirmation, server-side enforcement, and brute-force protection.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Brute-force throttling",
      "description": "The confirmation endpoint implements rate limiting or attempt counting — after a defined number of failed attempts, further attempts are blocked or the flow must restart.",
      "max_score": 50
    },
    {
      "name": "Flow restart on failure",
      "description": "After maximum failed verification attempts, the transaction token/credential is invalidated and a new flow must be started from scratch — the old token cannot be retried after lockout.",
      "max_score": 45
    },
    {
      "name": "Deny-by-default structure",
      "description": "The authorization logic defaults to denying the transaction unless all checks pass — the code structure does NOT allow-then-block, but rather blocks unless explicitly verified.",
      "max_score": 5
    }
  ]
}