{
    "scope": "Fictional document-read policy exercise, not an application security test or AI product benchmark.",
    "policy": "An existing document is readable only by its signed-in owner or a currently approved reader.",
    "fictional": true,
    "real_service_or_ai_model_tested": false,
    "variants": {
        "deny_all": "Always deny",
        "document_exists_only": "Allow if the document exists, without a permission check",
        "owner_or_current_reader": "Require a signed-in user, an existing document, and ownership or current reader approval"
    },
    "cases": [
        {
            "id": "owner",
            "label": "소유자",
            "user_id": "owner-a",
            "document": {
                "owner_id": "owner-a",
                "reader_ids": [
                    "reader-b"
                ]
            },
            "expected_allow": true,
            "actual_allow": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": true
            },
            "matches_expected": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": true
            }
        },
        {
            "id": "shared",
            "label": "승인된 공유 대상",
            "user_id": "reader-b",
            "document": {
                "owner_id": "owner-a",
                "reader_ids": [
                    "reader-b"
                ]
            },
            "expected_allow": true,
            "actual_allow": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": true
            },
            "matches_expected": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": true
            }
        },
        {
            "id": "unrelated",
            "label": "무관한 계정",
            "user_id": "visitor-c",
            "document": {
                "owner_id": "owner-a",
                "reader_ids": [
                    "reader-b"
                ]
            },
            "expected_allow": false,
            "actual_allow": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": false
            },
            "matches_expected": {
                "deny_all": true,
                "document_exists_only": false,
                "owner_or_current_reader": true
            }
        },
        {
            "id": "anonymous",
            "label": "로그인하지 않음",
            "user_id": null,
            "document": {
                "owner_id": "owner-a",
                "reader_ids": [
                    "reader-b"
                ]
            },
            "expected_allow": false,
            "actual_allow": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": false
            },
            "matches_expected": {
                "deny_all": true,
                "document_exists_only": false,
                "owner_or_current_reader": true
            }
        },
        {
            "id": "revoked",
            "label": "공유 승인 취소 뒤",
            "user_id": "reader-b",
            "document": {
                "owner_id": "owner-a",
                "reader_ids": []
            },
            "expected_allow": false,
            "actual_allow": {
                "deny_all": false,
                "document_exists_only": true,
                "owner_or_current_reader": false
            },
            "matches_expected": {
                "deny_all": true,
                "document_exists_only": false,
                "owner_or_current_reader": true
            }
        },
        {
            "id": "missing",
            "label": "존재하지 않는 문서",
            "user_id": "owner-a",
            "document": null,
            "expected_allow": false,
            "actual_allow": {
                "deny_all": false,
                "document_exists_only": false,
                "owner_or_current_reader": false
            },
            "matches_expected": {
                "deny_all": true,
                "document_exists_only": true,
                "owner_or_current_reader": true
            }
        }
    ],
    "summary": {
        "deny_all": {
            "allowed_cases_matched": 0,
            "denied_cases_matched": 4,
            "matched": 4,
            "total": 6
        },
        "document_exists_only": {
            "allowed_cases_matched": 2,
            "denied_cases_matched": 1,
            "matched": 3,
            "total": 6
        },
        "owner_or_current_reader": {
            "allowed_cases_matched": 2,
            "denied_cases_matched": 4,
            "matched": 6,
            "total": 6
        }
    },
    "not_tested": [
        "HTTP/API integration",
        "Authentication/session implementation",
        "Download and other document routes",
        "Concurrency and revocation races",
        "Production deployment"
    ]
}