{
  "context": "Evaluates whether the agent implements a correct HTTP API authorization policy in Rego, decoding a JWT token to extract claims, matching on HTTP method and path, and allowing access based on user identity and manager-subordinate relationships.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "import rego.v1",
      "description": "The policy file includes `import rego.v1`",
      "max_score": 11
    },
    {
      "name": "default allow := false",
      "description": "The policy defaults to denying all requests with `default allow := false`",
      "max_score": 11
    },
    {
      "name": "JWT decoded with io.jwt.decode",
      "description": "The policy decodes the JWT token from `input.token` using `io.jwt.decode` to extract claims",
      "max_score": 23
    },
    {
      "name": "Matches on input.method and input.path",
      "description": "The allow rule checks `input.method` (e.g. `\"GET\"`) and `input.path` (as an array, e.g. `[\"finance\", \"salary\", username]`)",
      "max_score": 23
    },
    {
      "name": "Allow self and manager access",
      "description": "The policy allows a user to access their own record and allows managers to access their subordinates' records",
      "max_score": 23
    },
    {
      "name": "Tests pass",
      "description": "All tests pass when running `opa test . -v`",
      "max_score": 9
    }
  ]
}