Starting inputs
A verified client identity
A non-secret credential identifier
One evidence-retrieval plan
A bounded validity interval
Ordered execution
Work the example
- 1
Authenticate the credential outside tool arguments.
- 2
Resolve its client and active grant.
- 3
Match the grant to the exact tool name.
- 4
Check validity window and quota.
- 5
Bind the terms digest into the grant snapshot.
Expected outputs
- An exact capability decision
- A quota-bearing grant identity
- No evidence output before authorization
Verification checks
- The terms digest matches the public contract.
- The credential is represented only by identifier or fingerprint.
- Expired or revoked grants refuse.
Fail closed
Refusal conditions
- Credential and grant belong to different clients.
- The tool is absent from allowedTools.
- A raw credential appears in a receipt.
Digest-bound public fixture
Check the expected state
This fixture contains synthetic operational fields only. Its digest establishes fixture integrity, not scientific truth or a completed commercial transaction.
{
"artifactKind": "licensed-delivery",
"schemaVersion": "maha-licensed-evidence/1.0",
"input": {
"planId": "evidence-developer-v1",
"allowedTools": [
"evidence.retrieve_released_record"
],
"termsSha256": "sha256:5c50f6b36dd890ff4d115c22fd0279df19bfba040d8695942aa7ab24c5085c7b"
},
"expected": {
"monthlyQuotaUnits": 10000,
"runtimeState": "private"
},
"artifactSha256": "sha256:5c71dc0a60cbb260767546e6b61e102b7fdc8723dbca85b991185b0b1936d787"
}