{
  "schema": "secopsnomad.identity-teaching-lab.v1",
  "fictional": true,
  "description": "Offline teaching data, not an identity-provider export or a production policy evaluator. No passwords, tokens or authenticators are included.",
  "timezone": "UTC",
  "policy": {
    "description": "Allow only an enabled account using its permitted sign-in channel with an active role granting the exact action and resource scope. Role grants add together; there are no explicit denies or nested groups. Temporary grants expire at the stated instant. These are this exercise's rules only.",
    "groups": {
      "employees": ["employee"],
      "finance_readers": ["invoice_reader"],
      "identity_admins": ["identity_admin"],
      "invoice_exporters": ["invoice_export"]
    },
    "roles": {
      "employee": [{"action": "profile.read", "scope": "self"}],
      "invoice_reader": [{"action": "invoices.read", "scope": "finance"}],
      "invoice_approver": [{"action": "invoices.approve", "scope": "finance"}],
      "identity_admin": [{"action": "access.manage", "scope": "directory"}],
      "invoice_export": [{"action": "invoices.read", "scope": "finance"}]
    }
  },
  "accounts": [
    {"id": "mira-01", "type": "human", "enabled": true, "channel": "interactive", "groups": ["employees", "finance_readers"], "temporary_roles": [{"role": "invoice_approver", "starts_at": "2026-10-27T09:00:00Z", "expires_at": "2026-10-27T09:15:00Z"}]},
    {"id": "ren-01", "type": "human", "enabled": true, "channel": "interactive", "groups": ["employees"], "temporary_roles": []},
    {"id": "mira-admin-01", "type": "privileged_human", "enabled": true, "channel": "interactive", "groups": ["identity_admins"], "temporary_roles": []},
    {"id": "svc-invoice-01", "type": "workload", "enabled": true, "channel": "workload", "groups": ["invoice_exporters"], "temporary_roles": []}
  ],
  "requests": [
    {"id": "R1", "time_utc": "2026-10-27T09:05:00Z", "account_id": "mira-01", "channel": "interactive", "action": "invoices.read", "resource_scope": "finance"},
    {"id": "R2", "time_utc": "2026-10-27T09:05:00Z", "account_id": "mira-01", "channel": "interactive", "action": "invoices.approve", "resource_scope": "finance"},
    {"id": "R3", "time_utc": "2026-10-27T09:15:00Z", "account_id": "mira-01", "channel": "interactive", "action": "invoices.approve", "resource_scope": "finance"},
    {"id": "R4", "time_utc": "2026-10-27T09:06:00Z", "account_id": "ren-01", "channel": "interactive", "action": "invoices.read", "resource_scope": "finance"},
    {"id": "R5", "time_utc": "2026-10-27T09:06:00Z", "account_id": "mira-admin-01", "channel": "interactive", "action": "invoices.read", "resource_scope": "finance"},
    {"id": "R6", "time_utc": "2026-10-27T09:06:00Z", "account_id": "mira-admin-01", "channel": "interactive", "action": "access.manage", "resource_scope": "directory"},
    {"id": "R7", "time_utc": "2026-10-27T09:07:00Z", "account_id": "svc-invoice-01", "channel": "workload", "action": "invoices.read", "resource_scope": "finance"},
    {"id": "R8", "time_utc": "2026-10-27T09:07:00Z", "account_id": "svc-invoice-01", "channel": "interactive", "action": "invoices.read", "resource_scope": "finance"},
    {"id": "R9", "time_utc": "2026-10-27T09:08:00Z", "account_id": "ren-01", "channel": "interactive", "action": "profile.read", "resource_scope": "self", "resource_owner": "mira-01"},
    {"id": "R10", "time_utc": "2026-10-27T09:08:00Z", "account_id": "ren-01", "channel": "interactive", "action": "profile.read", "resource_scope": "self", "resource_owner": "ren-01"}
  ],
  "case_note": {
    "description": "A separate fictional scenario, not the access-policy exercise. Security logs below report outcomes; they do not identify a person. Session labels are references, not credentials.",
    "report_en": "Mira reports an unexpected MFA prompt. Whether the successful sign-in, recovery change and export were authorised has not been established.",
    "report_ja": "Miraが身に覚えのないMFA要求を報告しました。成功したサインイン、復旧情報の変更、エクスポートが許可されたものかは未確認です。"
  },
  "events": [
    {"id": "E01", "time_utc": "2026-10-27T09:00:00Z", "source": "identity_sign_in", "account_id": "mira-01", "operation": "sign_in", "outcome": "success", "authentication": "password+totp", "session_ref": "s-mira-A", "source_ip": "192.0.2.24"},
    {"id": "E02", "time_utc": "2026-10-27T09:04:00Z", "source": "application_audit", "account_id": "mira-01", "operation": "invoices.read", "outcome": "success", "session_ref": "s-mira-A", "source_ip": "192.0.2.24"},
    {"id": "E03", "time_utc": "2026-10-27T09:10:00Z", "source": "identity_audit", "account_id": "mira-01", "operation": "recovery_method.added", "outcome": "success", "session_ref": "s-mira-A", "source_ip": "198.51.100.17"},
    {"id": "E04", "time_utc": "2026-10-27T09:11:00Z", "source": "identity_sign_in", "account_id": "mira-01", "operation": "sign_in", "outcome": "denied", "reason": "mfa_denied", "session_ref": null, "source_ip": "198.51.100.17"},
    {"id": "E05", "time_utc": "2026-10-27T09:12:00Z", "source": "application_audit", "account_id": "mira-01", "operation": "export.start", "outcome": "success", "session_ref": "s-mira-A", "source_ip": "198.51.100.17"},
    {"id": "E06", "time_utc": "2026-10-27T09:14:00Z", "source": "identity_audit", "account_id": "mira-01", "operation": "password_reset", "outcome": "success", "source_ip": null},
    {"id": "E07", "time_utc": "2026-10-27T09:15:00Z", "source": "application_audit", "account_id": "mira-01", "operation": "invoices.read", "outcome": "success", "session_ref": "s-mira-A", "source_ip": "198.51.100.17"},
    {"id": "E08", "time_utc": "2026-10-27T09:16:00Z", "source": "identity_audit", "account_id": "mira-01", "operation": "session_revoke_requested", "outcome": "success", "session_ref": "s-mira-A", "source_ip": null},
    {"id": "E09", "time_utc": "2026-10-27T09:16:30Z", "source": "application_audit", "account_id": "mira-01", "operation": "invoices.read", "outcome": "success", "session_ref": "s-mira-A", "source_ip": "198.51.100.17"},
    {"id": "E10", "time_utc": "2026-10-27T09:20:00Z", "source": "application_audit", "account_id": "mira-01", "operation": "invoices.read", "outcome": "denied", "reason": "session_not_accepted", "session_ref": "s-mira-A", "source_ip": "198.51.100.17"}
  ]
}