{
  "CONTROL_MAP.md": "# Sample control map\n164.312(b): one audit row per decision.\n",
  "DATA_FLOW.md": "# Sample data flow\nv0: one machine, SQLite. AWS install: in build.\n",
  "TOP20_ANSWERS.md": "# Sample reviewer answer\nInhold does not call models.\n",
  "THREAT_MODEL.md": "# Sample threat\nA database admin can rewrite a self-consistent audit chain.\n",
  "HASHING.md": "# Sample verification note\nCompare the chain against a previously trusted external head.\n",
  "policy/inhold.rego": "# Sample only, not a deployable policy.\npackage inhold\n",
  "audit/audit_events.jsonl": "{\"sample\":true,\"actor_id\":\"billing-agent\",\"action\":\"read\",\"object_id\":\"ctx_8f2c0a1b3d4e\",\"labels\":\"PHI\",\"purpose\":\"billing\",\"decision\":\"deny\",\"engine_hash\":\"sha256 of the policy engine\",\"session_id\":\"ses_sample\"}\n",
  "audit/chain_verification.json": "{\"sample\":true,\"why\":\"illustration only; no trusted anchor\"}\n",
  "anchors/anchors.jsonl": "{\"sample\":true,\"sig\":null}\n",
  "audit/summary.json": "{\"sample\":true,\"read:deny\":1}\n",
  "policy/active_bundle.json": "{\n  \"admin_actions\": {\n    \"audit_read\": [\n      \"auditor\",\n      \"policy_admin\"\n    ],\n    \"export\": [\n      \"auditor\"\n    ],\n    \"policy_change\": [\n      \"policy_admin\"\n    ],\n    \"skill_approve\": [\n      \"skill_approver\"\n    ]\n  },\n  \"agents\": {\n    \"billing-agent\": {\n      \"purposes\": [\n        \"billing\"\n      ]\n    },\n    \"prior-auth-agent\": {\n      \"purposes\": [\n        \"prior_auth\"\n      ]\n    }\n  },\n  \"humans\": {\n    \"himadmin.chen\": {\n      \"purposes\": [\n        \"records_admin\"\n      ],\n      \"roles\": [\n        \"policy_admin\",\n        \"skill_approver\"\n      ]\n    },\n    \"nurse.rivera\": {\n      \"purposes\": [\n        \"prior_auth\"\n      ],\n      \"roles\": [\n        \"clinician\",\n        \"skill_approver\"\n      ]\n    },\n    \"secops.okafor\": {\n      \"purposes\": [],\n      \"roles\": [\n        \"auditor\"\n      ]\n    }\n  },\n  \"purposes\": {\n    \"billing\": {\n      \"delete\": [],\n      \"read\": [\n        \"PII\",\n        \"internal\",\n        \"public\"\n      ],\n      \"reads_from\": [\n        \"billing\"\n      ],\n      \"write\": [\n        \"PII\",\n        \"internal\"\n      ]\n    },\n    \"prior_auth\": {\n      \"default_labels\": [\n        \"PHI\"\n      ],\n      \"delete\": [],\n      \"read\": [\n        \"PHI\",\n        \"PII\",\n        \"internal\",\n        \"public\"\n      ],\n      \"reads_from\": [\n        \"prior_auth\"\n      ],\n      \"write\": [\n        \"PHI\",\n        \"PII\",\n        \"internal\",\n        \"public\"\n      ]\n    },\n    \"records_admin\": {\n      \"delete\": [\n        \"PHI\",\n        \"PII\",\n        \"internal\",\n        \"public\"\n      ],\n      \"read\": [\n        \"PHI\",\n        \"PII\",\n        \"internal\",\n        \"public\"\n      ],\n      \"reads_from\": [\n        \"prior_auth\",\n        \"billing\",\n        \"records_admin\"\n      ],\n      \"write\": []\n    }\n  },\n  \"tenant\": \"contoso-general-hospital\"\n}\n",
  "deployment/egress_statement.md": "# Sample egress statement\nThe demo test blocks outbound connections. On a laptop it makes no outbound calls. In AWS mode it calls only STS for agent sign-in and S3 and KMS for anchors, through VPC endpoints. The AWS network controls are still in build.\n",
  "policy/active_bundle.sha256": "51c616cb4dc23c5e5f1560b791665592482a7e206320f08e30f17c4e62b33c5b",
  "MANIFEST.json": "{\n  \"files\": {\n    \"CONTROL_MAP.md\": \"e183b265e658b850a254dcf3e17e7fea0b0b166537015cff5fd9e574ddcae31f\",\n    \"DATA_FLOW.md\": \"403bfdd5e78b2ffed61fe218fdd55455a35217088de0c04c6df5b7763355a732\",\n    \"HASHING.md\": \"7516b2bcc98a3193ec49a11135807757b07b2651c2ae177028f0a781b390bffe\",\n    \"THREAT_MODEL.md\": \"a43ad4ddd734e0389713b67e1f85868e0857f9220018d06aa7d6e8910d63067d\",\n    \"TOP20_ANSWERS.md\": \"9340294271afc70ecc97c30df1f5882cb91273c9518cfeca41c1fe0a69e21c91\",\n    \"anchors/anchors.jsonl\": \"e14147a027f0d45aa748e082d20119bcad5c726bb9d8a78cdaa7d88e0da9e5dd\",\n    \"audit/audit_events.jsonl\": \"9542eac0e552f70b7892195f288432f0cba56de6aae53fa7101d22d5cb955d85\",\n    \"audit/chain_verification.json\": \"a131e9fa688cfcc9bcff6d3e7412dc669d1c80b72882900b334418e913336977\",\n    \"audit/summary.json\": \"637cb81dcc9fea61e64a1ef44154590cb1666478d98e0a2ff28c9c107395ef85\",\n    \"deployment/egress_statement.md\": \"b3d7867a8a5e987b8a8f7093fc1b7d3f0375afe86a225e94d7d11fa254fc4cb9\",\n    \"policy/active_bundle.json\": \"51c616cb4dc23c5e5f1560b791665592482a7e206320f08e30f17c4e62b33c5b\",\n    \"policy/active_bundle.sha256\": \"574a60a0a3942c2844e7ad656b2898a3d778a26094d63524820176b8778b9545\",\n    \"policy/inhold.rego\": \"793e72a1c31dd7065b070aab88a58775e5fa2e6e803e32432ac44e6ad14415c8\"\n  },\n  \"sample\": true\n}\n"
}