{
  "cases": 18,
  "generated_utc": "2026-11-02T02:49:45+00:00",
  "observations": [
    {
      "case_id": "C01",
      "case_name": "owner can read own document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C02",
      "case_name": "same tenant member may read peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Alpha operations"
        }
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C03",
      "case_name": "owner can update ordinary title",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Authorized update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized update",
          "before": "Alpha planning",
          "document": "101",
          "field": "title"
        }
      ],
      "variant": "secure"
    },
    {
      "case_id": "C04",
      "case_name": "tenant admin may update peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Authorized admin update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized admin update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "secure"
    },
    {
      "case_id": "C05",
      "case_name": "tenant admin user list scoped to tenant",
      "category": "positive control",
      "expected": "only_alpha_users",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C06",
      "case_name": "missing credentials rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C07",
      "case_name": "invalid token rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C08",
      "case_name": "cross-tenant document read blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C09",
      "case_name": "cross-tenant admin document modification blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C10",
      "case_name": "cross-tenant admin document deletion blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C11",
      "case_name": "query supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C12",
      "case_name": "header supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C13",
      "case_name": "header supplied tenant cannot permit foreign document read",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C14",
      "case_name": "ordinary member denied admin function",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "admin role required"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C15",
      "case_name": "ordinary member denied internal notes",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "admin role required"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C16",
      "case_name": "non-owner member denied title edit",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "write denied"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C17",
      "case_name": "protected document properties cannot be mass assigned",
      "category": "API3:2023 BOPLA",
      "expected": 400,
      "observed_status": 400,
      "oracle_pass": true,
      "response": {
        "error": "protected fields",
        "fields": [
          "approved",
          "owner",
          "tenant"
        ]
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C18",
      "case_name": "untrusted tenant header cannot let foreign admin edit",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "secure"
    },
    {
      "case_id": "C01",
      "case_name": "owner can read own document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C02",
      "case_name": "same tenant member may read peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Alpha operations"
        }
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C03",
      "case_name": "owner can update ordinary title",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Authorized update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized update",
          "before": "Alpha planning",
          "document": "101",
          "field": "title"
        }
      ],
      "variant": "object"
    },
    {
      "case_id": "C04",
      "case_name": "tenant admin may update peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Authorized admin update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized admin update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "object"
    },
    {
      "case_id": "C05",
      "case_name": "tenant admin user list scoped to tenant",
      "category": "positive control",
      "expected": "only_alpha_users",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C06",
      "case_name": "missing credentials rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C07",
      "case_name": "invalid token rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C08",
      "case_name": "cross-tenant document read blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Beta planning"
        }
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C09",
      "case_name": "cross-tenant admin document modification blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Unauthorized change"
        }
      },
      "state_mutations": [
        {
          "after": "Unauthorized change",
          "before": "Beta planning",
          "document": "201",
          "field": "title"
        }
      ],
      "variant": "object"
    },
    {
      "case_id": "C10",
      "case_name": "cross-tenant admin document deletion blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "deleted": "201"
      },
      "state_mutations": [
        {
          "action": "deleted",
          "document": "201"
        }
      ],
      "variant": "object"
    },
    {
      "case_id": "C11",
      "case_name": "query supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          },
          {
            "approved": false,
            "id": "201",
            "owner": "bob",
            "tenant": "beta",
            "title": "Beta planning"
          },
          {
            "approved": false,
            "id": "202",
            "owner": "admin-beta",
            "tenant": "beta",
            "title": "Beta operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C12",
      "case_name": "header supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          },
          {
            "approved": false,
            "id": "201",
            "owner": "bob",
            "tenant": "beta",
            "title": "Beta planning"
          },
          {
            "approved": false,
            "id": "202",
            "owner": "admin-beta",
            "tenant": "beta",
            "title": "Beta operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C13",
      "case_name": "header supplied tenant cannot permit foreign document read",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Beta planning"
        }
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C14",
      "case_name": "ordinary member denied admin function",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "admin role required"
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C15",
      "case_name": "ordinary member denied internal notes",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "admin role required"
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C16",
      "case_name": "non-owner member denied title edit",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "write denied"
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C17",
      "case_name": "protected document properties cannot be mass assigned",
      "category": "API3:2023 BOPLA",
      "expected": 400,
      "observed_status": 400,
      "oracle_pass": true,
      "response": {
        "error": "protected fields",
        "fields": [
          "approved",
          "owner",
          "tenant"
        ]
      },
      "state_mutations": [],
      "variant": "object"
    },
    {
      "case_id": "C18",
      "case_name": "untrusted tenant header cannot let foreign admin edit",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Header-spoofed update"
        }
      },
      "state_mutations": [
        {
          "after": "Header-spoofed update",
          "before": "Beta planning",
          "document": "201",
          "field": "title"
        }
      ],
      "variant": "object"
    },
    {
      "case_id": "C01",
      "case_name": "owner can read own document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C02",
      "case_name": "same tenant member may read peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Alpha operations"
        }
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C03",
      "case_name": "owner can update ordinary title",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Authorized update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized update",
          "before": "Alpha planning",
          "document": "101",
          "field": "title"
        }
      ],
      "variant": "function"
    },
    {
      "case_id": "C04",
      "case_name": "tenant admin may update peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Authorized admin update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized admin update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "function"
    },
    {
      "case_id": "C05",
      "case_name": "tenant admin user list scoped to tenant",
      "category": "positive control",
      "expected": "only_alpha_users",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C06",
      "case_name": "missing credentials rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C07",
      "case_name": "invalid token rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C08",
      "case_name": "cross-tenant document read blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C09",
      "case_name": "cross-tenant admin document modification blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C10",
      "case_name": "cross-tenant admin document deletion blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C11",
      "case_name": "query supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C12",
      "case_name": "header supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C13",
      "case_name": "header supplied tenant cannot permit foreign document read",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C14",
      "case_name": "ordinary member denied admin function",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C15",
      "case_name": "ordinary member denied internal notes",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "internal_notes": "Synthetic alpha private note"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C16",
      "case_name": "non-owner member denied title edit",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Unauthorized peer update"
        }
      },
      "state_mutations": [
        {
          "after": "Unauthorized peer update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "function"
    },
    {
      "case_id": "C17",
      "case_name": "protected document properties cannot be mass assigned",
      "category": "API3:2023 BOPLA",
      "expected": 400,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": true,
          "id": "101",
          "owner": "bob",
          "tenant": "beta",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [
        {
          "after": "beta",
          "before": "alpha",
          "document": "101",
          "field": "tenant"
        },
        {
          "after": "bob",
          "before": "alice",
          "document": "101",
          "field": "owner"
        },
        {
          "after": true,
          "before": false,
          "document": "101",
          "field": "approved"
        }
      ],
      "variant": "function"
    },
    {
      "case_id": "C18",
      "case_name": "untrusted tenant header cannot let foreign admin edit",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "function"
    },
    {
      "case_id": "C01",
      "case_name": "owner can read own document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C02",
      "case_name": "same tenant member may read peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Alpha operations"
        }
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C03",
      "case_name": "owner can update ordinary title",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Authorized update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized update",
          "before": "Alpha planning",
          "document": "101",
          "field": "title"
        }
      ],
      "variant": "context"
    },
    {
      "case_id": "C04",
      "case_name": "tenant admin may update peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Authorized admin update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized admin update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "context"
    },
    {
      "case_id": "C05",
      "case_name": "tenant admin user list scoped to tenant",
      "category": "positive control",
      "expected": "only_alpha_users",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C06",
      "case_name": "missing credentials rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C07",
      "case_name": "invalid token rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C08",
      "case_name": "cross-tenant document read blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C09",
      "case_name": "cross-tenant admin document modification blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C10",
      "case_name": "cross-tenant admin document deletion blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "outside tenant"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C11",
      "case_name": "query supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "201",
            "owner": "bob",
            "tenant": "beta",
            "title": "Beta planning"
          },
          {
            "approved": false,
            "id": "202",
            "owner": "admin-beta",
            "tenant": "beta",
            "title": "Beta operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C12",
      "case_name": "header supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "201",
            "owner": "bob",
            "tenant": "beta",
            "title": "Beta planning"
          },
          {
            "approved": false,
            "id": "202",
            "owner": "admin-beta",
            "tenant": "beta",
            "title": "Beta operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C13",
      "case_name": "header supplied tenant cannot permit foreign document read",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Beta planning"
        }
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C14",
      "case_name": "ordinary member denied admin function",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "admin role required"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C15",
      "case_name": "ordinary member denied internal notes",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "admin role required"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C16",
      "case_name": "non-owner member denied title edit",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 403,
      "oracle_pass": true,
      "response": {
        "error": "write denied"
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C17",
      "case_name": "protected document properties cannot be mass assigned",
      "category": "API3:2023 BOPLA",
      "expected": 400,
      "observed_status": 400,
      "oracle_pass": true,
      "response": {
        "error": "protected fields",
        "fields": [
          "approved",
          "owner",
          "tenant"
        ]
      },
      "state_mutations": [],
      "variant": "context"
    },
    {
      "case_id": "C18",
      "case_name": "untrusted tenant header cannot let foreign admin edit",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Header-spoofed update"
        }
      },
      "state_mutations": [
        {
          "after": "Header-spoofed update",
          "before": "Beta planning",
          "document": "201",
          "field": "title"
        }
      ],
      "variant": "context"
    },
    {
      "case_id": "C01",
      "case_name": "owner can read own document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C02",
      "case_name": "same tenant member may read peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Alpha operations"
        }
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C03",
      "case_name": "owner can update ordinary title",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "101",
          "owner": "alice",
          "tenant": "alpha",
          "title": "Authorized update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized update",
          "before": "Alpha planning",
          "document": "101",
          "field": "title"
        }
      ],
      "variant": "combined"
    },
    {
      "case_id": "C04",
      "case_name": "tenant admin may update peer document",
      "category": "positive control",
      "expected": 200,
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Authorized admin update"
        }
      },
      "state_mutations": [
        {
          "after": "Authorized admin update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "combined"
    },
    {
      "case_id": "C05",
      "case_name": "tenant admin user list scoped to tenant",
      "category": "positive control",
      "expected": "only_alpha_users",
      "observed_status": 200,
      "oracle_pass": true,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C06",
      "case_name": "missing credentials rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C07",
      "case_name": "invalid token rejected",
      "category": "authentication",
      "expected": 401,
      "observed_status": 401,
      "oracle_pass": true,
      "response": {
        "error": "unauthenticated"
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C08",
      "case_name": "cross-tenant document read blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Beta planning"
        }
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C09",
      "case_name": "cross-tenant admin document modification blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Unauthorized change"
        }
      },
      "state_mutations": [
        {
          "after": "Unauthorized change",
          "before": "Beta planning",
          "document": "201",
          "field": "title"
        }
      ],
      "variant": "combined"
    },
    {
      "case_id": "C10",
      "case_name": "cross-tenant admin document deletion blocked",
      "category": "API1:2023 BOLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "deleted": "201"
      },
      "state_mutations": [
        {
          "action": "deleted",
          "document": "201"
        }
      ],
      "variant": "combined"
    },
    {
      "case_id": "C11",
      "case_name": "query supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          },
          {
            "approved": false,
            "id": "201",
            "owner": "bob",
            "tenant": "beta",
            "title": "Beta planning"
          },
          {
            "approved": false,
            "id": "202",
            "owner": "admin-beta",
            "tenant": "beta",
            "title": "Beta operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C12",
      "case_name": "header supplied tenant cannot redirect document list",
      "category": "untrusted context",
      "expected": "only_alpha_docs",
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "documents": [
          {
            "approved": false,
            "id": "101",
            "owner": "alice",
            "tenant": "alpha",
            "title": "Alpha planning"
          },
          {
            "approved": false,
            "id": "102",
            "owner": "charlie",
            "tenant": "alpha",
            "title": "Alpha operations"
          },
          {
            "approved": false,
            "id": "201",
            "owner": "bob",
            "tenant": "beta",
            "title": "Beta planning"
          },
          {
            "approved": false,
            "id": "202",
            "owner": "admin-beta",
            "tenant": "beta",
            "title": "Beta operations"
          }
        ]
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C13",
      "case_name": "header supplied tenant cannot permit foreign document read",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Beta planning"
        }
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C14",
      "case_name": "ordinary member denied admin function",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "users": [
          {
            "id": "alice",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "charlie",
            "role": "member",
            "tenant": "alpha"
          },
          {
            "id": "admin-alpha",
            "role": "admin",
            "tenant": "alpha"
          }
        ]
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C15",
      "case_name": "ordinary member denied internal notes",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "internal_notes": "Synthetic alpha private note"
      },
      "state_mutations": [],
      "variant": "combined"
    },
    {
      "case_id": "C16",
      "case_name": "non-owner member denied title edit",
      "category": "API5:2023 BFLA",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "102",
          "owner": "charlie",
          "tenant": "alpha",
          "title": "Unauthorized peer update"
        }
      },
      "state_mutations": [
        {
          "after": "Unauthorized peer update",
          "before": "Alpha operations",
          "document": "102",
          "field": "title"
        }
      ],
      "variant": "combined"
    },
    {
      "case_id": "C17",
      "case_name": "protected document properties cannot be mass assigned",
      "category": "API3:2023 BOPLA",
      "expected": 400,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": true,
          "id": "101",
          "owner": "bob",
          "tenant": "beta",
          "title": "Alpha planning"
        }
      },
      "state_mutations": [
        {
          "after": "beta",
          "before": "alpha",
          "document": "101",
          "field": "tenant"
        },
        {
          "after": "bob",
          "before": "alice",
          "document": "101",
          "field": "owner"
        },
        {
          "after": true,
          "before": false,
          "document": "101",
          "field": "approved"
        }
      ],
      "variant": "combined"
    },
    {
      "case_id": "C18",
      "case_name": "untrusted tenant header cannot let foreign admin edit",
      "category": "untrusted context",
      "expected": 403,
      "observed_status": 200,
      "oracle_pass": false,
      "response": {
        "document": {
          "approved": false,
          "id": "201",
          "owner": "bob",
          "tenant": "beta",
          "title": "Header-spoofed update"
        }
      },
      "state_mutations": [
        {
          "after": "Header-spoofed update",
          "before": "Beta planning",
          "document": "201",
          "field": "title"
        }
      ],
      "variant": "combined"
    }
  ],
  "python": "3.13.5",
  "scope": "Synthetic application bound exclusively to 127.0.0.1; no external testing",
  "study": "Aspirehive multi-tenant API authorization invariant lab",
  "summary": {
    "combined": {
      "checks": 18,
      "failed": 11,
      "failed_case_ids": [
        "C08",
        "C09",
        "C10",
        "C11",
        "C12",
        "C13",
        "C14",
        "C15",
        "C16",
        "C17",
        "C18"
      ],
      "passed": 7
    },
    "context": {
      "checks": 18,
      "failed": 4,
      "failed_case_ids": [
        "C11",
        "C12",
        "C13",
        "C18"
      ],
      "passed": 14
    },
    "function": {
      "checks": 18,
      "failed": 4,
      "failed_case_ids": [
        "C14",
        "C15",
        "C16",
        "C17"
      ],
      "passed": 14
    },
    "object": {
      "checks": 18,
      "failed": 7,
      "failed_case_ids": [
        "C08",
        "C09",
        "C10",
        "C11",
        "C12",
        "C13",
        "C18"
      ],
      "passed": 11
    },
    "secure": {
      "checks": 18,
      "failed": 0,
      "failed_case_ids": [],
      "passed": 18
    }
  },
  "variants": [
    "secure",
    "object",
    "function",
    "context",
    "combined"
  ]
}