{
  "schema_version": "ews-audit-output/v3",
  "binary_version": "0.3.0-rc.2",
  "tenant_html_version": "ews-tenant-evidence-html/v3",
  "run_fingerprint": "e8b0c9535daefa375f7ce76ca68386ca2f4e9ca2bcdef9a66d9b408af01d1077",
  "prototype_label": "PROTOTYPE",
  "synthetic": true,
  "portfolio_status": "COMPLETE",
  "tenant_key": "fictional-beta",
  "as_of_utc": "2026-08-10T12:00:00Z",
  "report_window_days": [
    90
  ],
  "coverage_limitations": [
    "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
    "GRAPH_EVENTUAL_CONSISTENCY",
    "IDENTITY_NOT_VERIFIED",
    "MAILBOX_IMPACT_UNMAPPED",
    "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
    "NO_LIVE_AUTHORIZATION_CHECK",
    "POLICY_SOURCE_TIME_BOUND",
    "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED",
    "USAGE_WINDOW_ONLY",
    "WEEKLY_AGGREGATION"
  ],
  "sources": [
    {
      "source_evidence_id": "src-decisions",
      "kind": "decisions",
      "sha256": "45e614cb56e372056df83ad4b664508ff873376fad976a9f37b411cfde7789c5",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-decisions",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "NORMALIZED_MANUAL",
        "scope": "REVIEWED_DECISIONS",
        "limitations": []
      }
    },
    {
      "source_evidence_id": "src-fictional-beta-collector",
      "kind": "collector_manifest",
      "sha256": "33daa965c5a34c18c3f6b6422667605db6943bc5c5d63689db17ad63193b62d2",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-collector",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "MICROSOFT_365_POWERSHELL_COLLECTOR",
        "scope": "COMPLETE_AUDIT_COLLECTION",
        "limitations": [
          "GRAPH_EVENTUAL_CONSISTENCY",
          "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
          "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED"
        ]
      }
    },
    {
      "source_evidence_id": "src-fictional-beta-config",
      "kind": "organization_config_v2",
      "sha256": "7c2a58618f4a1a0edd4326efa306a272a3e9f36ddf087348a70437c8e571810a",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-config",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "EXCHANGE_ONLINE_POWERSHELL",
        "scope": "ORGANIZATION_EWS_POLICY",
        "limitations": []
      }
    },
    {
      "source_evidence_id": "src-fictional-beta-mailbox",
      "kind": "mailbox_override_summary",
      "sha256": "09796f6b1ac87b49dc1ef18bc2b15a43107280170bd7a2e2f7be87b60720585c",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-mailbox-summary",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "EXCHANGE_ONLINE_POWERSHELL",
        "scope": "MAILBOX_EWS_OVERRIDE_AGGREGATE",
        "limitations": [
          "MAILBOX_IMPACT_UNMAPPED"
        ]
      }
    },
    {
      "source_evidence_id": "src-fictional-beta-permissions",
      "kind": "permission_evidence",
      "sha256": "d4c3f4ee01e6d903bf299f0a604441d9575fc81f059f4691c508429e013bfbfb",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-permissions",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "MICROSOFT_GRAPH",
        "scope": "EWS_PERMISSION_EVIDENCE",
        "limitations": [
          "GRAPH_EVENTUAL_CONSISTENCY",
          "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
          "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED"
        ]
      }
    },
    {
      "source_evidence_id": "src-fictional-beta-usage",
      "kind": "usage",
      "sha256": "bc354c72e1ec9bd75775cd3f207e0f2df0fb2a7421c44a5f419d57265b09dde6",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-usage",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "NORMALIZED_MANUAL",
        "scope": "EWS_USAGE_WINDOW",
        "limitations": [
          "USAGE_WINDOW_ONLY",
          "WEEKLY_AGGREGATION"
        ]
      }
    }
  ],
  "applications": [
    {
      "application_id": "00000000-0000-4000-8000-000000000021",
      "display_name": null,
      "owner_claims": {
        "observed_owner": {
          "status": "NOT_OBSERVED",
          "value": null,
          "source_evidence_ids": [],
          "source_refs": [],
          "limitations": []
        },
        "ownership_verification": {
          "status": "NOT_VERIFIED",
          "value": null,
          "source_evidence_ids": [],
          "source_refs": [],
          "limitations": []
        },
        "ews_usage_claim": {
          "status": "OBSERVED_IN_WINDOW",
          "value": "90",
          "source_evidence_ids": [
            "src-fictional-beta-usage"
          ],
          "source_refs": [],
          "limitations": [
            "USAGE_WINDOW_ONLY"
          ]
        },
        "allowlist_recommendation": {
          "status": "REVIEWED_MIGRATE",
          "value": "migrate",
          "source_evidence_ids": [
            "src-fictional-beta-usage"
          ],
          "source_refs": [],
          "limitations": []
        }
      },
      "evidence_ids": [
        "src-decisions",
        "src-fictional-beta-config",
        "src-fictional-beta-permissions",
        "src-fictional-beta-usage"
      ]
    }
  ],
  "usage": [
    {
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "soap_action": "FindItem",
      "report_window_days": 90,
      "source_evidence_id": "src-fictional-beta-usage",
      "call_volume": 11,
      "last_activity_utc": "2026-08-10T10:05:00Z",
      "source_row_numbers": [
        1
      ]
    }
  ],
  "permission_reconciliation": [
    {
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "usage_state": "OBSERVED_IN_WINDOW",
      "app_only_right_state": "OBSERVED",
      "delegated_tenantwide_state": "OBSERVED",
      "delegated_principal_state": "NOT_OBSERVED",
      "principal_grant_count": 0,
      "quadrant": "USES_WITH_OBSERVED_RIGHT",
      "evidence_ids": [
        "src-fictional-beta-config",
        "src-fictional-beta-permissions",
        "src-fictional-beta-usage"
      ],
      "limitations": [
        "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
        "GRAPH_EVENTUAL_CONSISTENCY",
        "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
        "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED",
        "USAGE_WINDOW_ONLY",
        "WEEKLY_AGGREGATION"
      ]
    }
  ],
  "organization_policy_model": [
    {
      "policy_model_version": "ews-policy-model/v1",
      "policy_phase": "ENFORCEMENT_TARGET",
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "ews_enabled_state": "NULL",
      "app_id_list_state": "EMPTY",
      "membership": "ABSENT",
      "modeled_outcome": "MODELED_PHASED_BLOCK",
      "rule_id": "ENF-NULL-ANY",
      "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29",
      "evidence_ids": [
        "src-fictional-beta-config",
        "src-fictional-beta-mailbox"
      ],
      "limitations": [
        "MAILBOX_IMPACT_UNMAPPED",
        "POLICY_SOURCE_TIME_BOUND"
      ]
    },
    {
      "policy_model_version": "ews-policy-model/v1",
      "policy_phase": "PRE_ENFORCEMENT",
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "ews_enabled_state": "NULL",
      "app_id_list_state": "EMPTY",
      "membership": "ABSENT",
      "modeled_outcome": "MODELED_ALLOWED",
      "rule_id": "PRE-NULL-ANY",
      "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29",
      "evidence_ids": [
        "src-fictional-beta-config",
        "src-fictional-beta-mailbox"
      ],
      "limitations": [
        "MAILBOX_IMPACT_UNMAPPED",
        "NO_LIVE_AUTHORIZATION_CHECK",
        "POLICY_SOURCE_TIME_BOUND"
      ]
    }
  ],
  "mailbox_override_summary": {
    "tenant_key": "fictional-beta",
    "evidence_status": "OBSERVED_COMPLETE",
    "true_count": 1,
    "false_count": 2,
    "null_count": 3,
    "total_count": 6,
    "limitations": [
      "MAILBOX_IMPACT_UNMAPPED"
    ]
  },
  "findings": [
    {
      "finding_id": "finding-fictional-beta-00000000-0000-4000-8000-000000000021-observed_not_allowlisted",
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "state": "OBSERVED_NOT_ALLOWLISTED",
      "severity": "REVIEW",
      "explanation_code": "R_OBSERVED_NOT_ALLOWLISTED",
      "evidence_ids": [
        "src-fictional-beta-config",
        "src-fictional-beta-permissions",
        "src-fictional-beta-usage"
      ],
      "limitations": [
        "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
        "GRAPH_EVENTUAL_CONSISTENCY",
        "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
        "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED",
        "USAGE_WINDOW_ONLY",
        "WEEKLY_AGGREGATION",
        "W_OWNER_UNKNOWN"
      ]
    }
  ],
  "decisions": [
    {
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "decision": "migrate",
      "rationale": "fictional-beta-reviewed",
      "owner_alias": "fictional-owner-beta",
      "target_date": "2026-09-02",
      "review_status": "REVIEWED",
      "reviewed_by_alias": "fictional-reviewer-beta",
      "evidence_ids": [
        "src-fictional-beta-usage"
      ]
    }
  ],
  "configuration_proposals": [
    {
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "current_snapshot_sha256": "7c2a58618f4a1a0edd4326efa306a272a3e9f36ddf087348a70437c8e571810a",
      "current_full_app_id_set": [],
      "target_state": "NO_TARGET",
      "prospective_full_app_id_set": [],
      "add_delta": [],
      "remove_delta": [],
      "current_membership": "ABSENT",
      "candidate_membership": "UNSPECIFIED",
      "desired_membership": "UNSPECIFIED",
      "eligibility": "BLOCKED",
      "decision": "migrate",
      "decision_review_status": "REVIEWED",
      "blocking_codes": [
        "KEEP_OR_MIGRATE_TARGET_NOT_ALLOWED"
      ],
      "warning_codes": [
        "CURRENT_ALLOWLIST_ORIGIN_UNVERIFIED",
        "FULL_REPLACE_REVIEW_REQUIRED",
        "MAILBOX_IMPACT_UNMAPPED",
        "MIGRATION_NOT_VERIFIED"
      ],
      "precondition_codes": [
        "ALL_DECISIONS_REVIEWED",
        "CURRENT_SNAPSHOT_HASH_MATCH",
        "ENFORCEMENT_TARGET_ALLOWED",
        "FULL_REPLACE_REVIEW_ACK_REQUIRED"
      ],
      "review_checklist_codes": [
        "AUTHORIZE_CHANGE_OUTSIDE_PRODUCT",
        "REVIEW_ADD_DELTA",
        "REVIEW_CURRENT_FULL_SET",
        "REVIEW_LEGACY_POLICY",
        "REVIEW_MAILBOX_LIMITATIONS",
        "REVIEW_REMOVE_DELTA"
      ],
      "evidence_ids": [
        "src-fictional-beta-config",
        "src-fictional-beta-mailbox",
        "src-fictional-beta-permissions",
        "src-fictional-beta-usage"
      ]
    }
  ],
  "unknown_evidence": [
    {
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "dimension": "OWNER_IDENTITY",
      "evidence_status": "NOT_COLLECTED",
      "reason_code": "IDENTITY_NOT_VERIFIED",
      "source_ref": "APPLICATION_CONTEXT",
      "limitations": [
        "IDENTITY_NOT_VERIFIED"
      ]
    }
  ],
  "unknown_owners": [
    {
      "tenant_key": "fictional-beta",
      "application_id": "00000000-0000-4000-8000-000000000021",
      "display_name": "",
      "observed_state": "OBSERVED_NOT_ALLOWLISTED",
      "reason_code": "W_OWNER_UNKNOWN",
      "evidence_ids": [
        "src-fictional-beta-config",
        "src-fictional-beta-permissions",
        "src-fictional-beta-usage"
      ]
    }
  ]
}