Reading the decision trail…
Every decision, newest first, with how far the request got: token, audience, scope chain, approval. The reason is the closed vocabulary the server, the tests and this console all name identically — a denial whose reason is a sentence somebody typed is a denial nobody can aggregate.
A stage marked not checked is one that verifier does not perform. That is the comparison: the naive baseline does not fail the audience check, it has no audience check.
A committed measurement, not a live broker. BROKER_API_BASE_URL is unset, so all four screens render the artifacts committed under artifacts/ — written by one run of python -m agent_authz_broker.demo against real PostgreSQL. It executes every scenario under both policies, counts irreversible_effect rows from a clean database each time, and exports the audit_event rows it wrote, the approvals it left behind, and each delegation chain decoded from the token that was actually presented. Every number here was measured; none was typed. Attached to a running broker, these same screens show that database live.
| When | Caller | Policy | Trail | Outcome | Effect |
|---|---|---|---|---|---|
2026-09-13T12:21:49.054272+00:00 aud_339279782d734881 | agent-7 issue_credit | hardened |
effective [account:read, credit:issue] · needs credit:issue | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. | none |
2026-09-13T12:21:49.032996+00:00 aud_e0065fb9f2bb4c86 | agent-7 issue_credit | hardened |
effective [account:read, credit:issue] · needs credit:issue | allowed no refusal | eff_0325bcbd844c4f51 |
2026-09-13T12:21:48.965818+00:00 aud_b168214211d441e6 | agent-7 issue_credit | naive |
effective [account:read, credit:issue] · needs credit:issue | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. | none |
2026-09-13T12:21:48.952320+00:00 aud_8334310bc6b84d56 | agent-7 issue_credit | naive |
effective [account:read, credit:issue] · needs credit:issue | allowed no refusal | eff_0a42a69a21a04648 |
2026-09-13T12:21:48.898691+00:00 aud_dbc8a51af475461c | agent-7 issue_credit | hardened |
effective [account:read, credit:issue] · needs credit:issue | denied approval_expired An approval was found and it is past its expiry. | none |
2026-09-13T12:21:48.850900+00:00 aud_1023ea91cbaf44c7 | agent-7 issue_credit | naive |
effective [account:read, credit:issue] · needs credit:issue | denied approval_expired An approval was found and it is past its expiry. | none |
2026-09-13T12:21:48.794685+00:00 aud_b81f4bf9459043f4 | agent-7 issue_credit | hardened |
effective [account:read, credit:issue] · needs credit:issue | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. | none |
2026-09-13T12:21:48.707569+00:00 aud_2bc8f836ba03421d | agent-7 issue_credit | naive |
effective [account:read, credit:issue] · needs credit:issue | denied approval_required No matching, unexpired, unconsumed approval exists in this server's database. | none |
2026-09-13T12:21:48.672231+00:00 aud_275c23f77d944570 | agent-7 issue_credit | hardened |
effective [account:flag, account:read] · needs credit:issue | denied insufficient_effective_scope The scope survived by the whole delegation chain does not include what this tool needs. | none |
2026-09-13T12:21:48.597478+00:00 aud_bd2e5f9fc25e4857 | agent-7 issue_credit | naive |
effective [account:flag, account:read, credit:issue] · needs credit:issue | allowed no refusal | eff_d19f2ce711bc41d0 |
2026-09-13T12:21:48.481301+00:00 aud_55b34f25a86c43b6 | agent-7 issue_credit | hardened |
effective [account:read, credit:issue] · needs credit:issue | denied audience_mismatch Minted for a different resource server. This one is not its audience. | none |
2026-09-13T12:21:48.413468+00:00 aud_55b66698dd4240ad | agent-7 issue_credit | naive |
effective [account:read, credit:issue] · needs credit:issue | allowed no refusal | eff_67d255f556f745f3 |
2026-09-13T12:21:48.358828+00:00 aud_7032f298d9004950 | agent-7 issue_credit | hardened |
effective [account:read, credit:issue] · needs credit:issue | allowed no refusal | eff_d6666e528c7b443d |
2026-09-13T12:21:48.251543+00:00 aud_e1e3e5d5d0f64c2c | agent-7 issue_credit | naive |
effective [account:read, credit:issue] · needs credit:issue | allowed no refusal | eff_65d8da439ec54a80 |