{
  "schema_version": "ews-audit-output/v3",
  "binary_version": "0.3.0-rc.2",
  "tenant_html_version": "ews-tenant-evidence-html/v3",
  "run_fingerprint": "e8b0c9535daefa375f7ce76ca68386ca2f4e9ca2bcdef9a66d9b408af01d1077",
  "prototype_label": "PROTOTYPE",
  "synthetic": true,
  "portfolio_status": "COMPLETE",
  "tenant_key": "fictional-gamma",
  "as_of_utc": "2026-08-10T12:00:00Z",
  "report_window_days": [
    90
  ],
  "coverage_limitations": [
    "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
    "APP_ID_PARAMETER_UNAVAILABLE",
    "GRAPH_EVENTUAL_CONSISTENCY",
    "IDENTITY_NOT_VERIFIED",
    "LEGACY_POLICY_INTERACTION_UNRESOLVED",
    "MAILBOX_IMPACT_UNMAPPED",
    "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
    "POLICY_INPUT_INCOMPLETE",
    "POLICY_SOURCE_TIME_BOUND",
    "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED",
    "USAGE_WINDOW_ONLY",
    "WEEKLY_AGGREGATION"
  ],
  "sources": [
    {
      "source_evidence_id": "src-decisions",
      "kind": "decisions",
      "sha256": "45e614cb56e372056df83ad4b664508ff873376fad976a9f37b411cfde7789c5",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-decisions",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "NORMALIZED_MANUAL",
        "scope": "REVIEWED_DECISIONS",
        "limitations": []
      }
    },
    {
      "source_evidence_id": "src-fictional-gamma-collector",
      "kind": "collector_manifest",
      "sha256": "af60eb929414b66c80d9180ba6ee439c84153852589f4ac7fb38f972c71ed565",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-collector",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "MICROSOFT_365_POWERSHELL_COLLECTOR",
        "scope": "COMPLETE_AUDIT_COLLECTION",
        "limitations": [
          "GRAPH_EVENTUAL_CONSISTENCY",
          "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
          "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED"
        ]
      }
    },
    {
      "source_evidence_id": "src-fictional-gamma-config",
      "kind": "organization_config_v2",
      "sha256": "5559d2e18ee12b4980f069bf248e7528f464a2e139ab0d84fa2091b1ebbdad88",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-config",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "EXCHANGE_ONLINE_POWERSHELL",
        "scope": "ORGANIZATION_EWS_POLICY",
        "limitations": []
      }
    },
    {
      "source_evidence_id": "src-fictional-gamma-mailbox",
      "kind": "mailbox_override_summary",
      "sha256": "43f847a19bc80b76f0e579b6c1fc188a9a42d20f9824a0b93ef31741891ec482",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-mailbox-summary",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "EXCHANGE_ONLINE_POWERSHELL",
        "scope": "MAILBOX_EWS_OVERRIDE_AGGREGATE",
        "limitations": [
          "MAILBOX_IMPACT_UNMAPPED"
        ]
      }
    },
    {
      "source_evidence_id": "src-fictional-gamma-permissions",
      "kind": "permission_evidence",
      "sha256": "287bd705e56e7b1ac76da83e635d3c0f53c47d6fd529dafc4b7af359aaaedf6f",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "OBSERVED_COMPLETE",
        "source_ref": "fictional-permissions",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "MICROSOFT_GRAPH",
        "scope": "EWS_PERMISSION_EVIDENCE",
        "limitations": [
          "GRAPH_EVENTUAL_CONSISTENCY",
          "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
          "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED"
        ]
      }
    },
    {
      "source_evidence_id": "src-fictional-gamma-usage",
      "kind": "usage",
      "sha256": "3f95d31ab41b29a18737dc79b6fa13bbbbc5a763c6fc72f45c5db598c7376ac2",
      "captured_at_utc": "2026-08-10T11:30:00Z",
      "evidence": {
        "status": "UNAVAILABLE",
        "source_ref": "fictional-usage",
        "captured_at_utc": "2026-08-10T11:30:00Z",
        "method": "NORMALIZED_MANUAL",
        "scope": "EWS_USAGE_WINDOW",
        "limitations": [
          "USAGE_WINDOW_ONLY",
          "WEEKLY_AGGREGATION"
        ]
      }
    }
  ],
  "applications": [
    {
      "application_id": "00000000-0000-4000-8000-000000000031",
      "display_name": null,
      "owner_claims": {
        "observed_owner": {
          "status": "NOT_OBSERVED",
          "value": null,
          "source_evidence_ids": [],
          "source_refs": [],
          "limitations": []
        },
        "ownership_verification": {
          "status": "NOT_VERIFIED",
          "value": null,
          "source_evidence_ids": [],
          "source_refs": [],
          "limitations": []
        },
        "ews_usage_claim": {
          "status": "UNKNOWN",
          "value": null,
          "source_evidence_ids": [],
          "source_refs": [],
          "limitations": []
        },
        "allowlist_recommendation": {
          "status": "UNREVIEWED",
          "value": null,
          "source_evidence_ids": [],
          "source_refs": [],
          "limitations": []
        }
      },
      "evidence_ids": [
        "src-decisions",
        "src-fictional-gamma-config",
        "src-fictional-gamma-permissions",
        "src-fictional-gamma-usage"
      ]
    }
  ],
  "usage": [],
  "permission_reconciliation": [
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "usage_state": "UNKNOWN",
      "app_only_right_state": "OBSERVED",
      "delegated_tenantwide_state": "NOT_OBSERVED",
      "delegated_principal_state": "OBSERVED",
      "principal_grant_count": 3,
      "quadrant": "CANNOT_DETERMINE",
      "evidence_ids": [
        "src-fictional-gamma-config",
        "src-fictional-gamma-permissions",
        "src-fictional-gamma-usage"
      ],
      "limitations": [
        "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
        "APP_ID_PARAMETER_UNAVAILABLE",
        "GRAPH_EVENTUAL_CONSISTENCY",
        "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
        "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED",
        "USAGE_WINDOW_ONLY",
        "WEEKLY_AGGREGATION"
      ]
    }
  ],
  "organization_policy_model": [
    {
      "policy_model_version": "ews-policy-model/v1",
      "policy_phase": "ENFORCEMENT_TARGET",
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "ews_enabled_state": "NULL",
      "app_id_list_state": "UNKNOWN",
      "membership": "UNKNOWN",
      "modeled_outcome": "CANNOT_DETERMINE",
      "rule_id": "CANNOT-APPID-PARAMETER",
      "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29",
      "evidence_ids": [
        "src-fictional-gamma-config",
        "src-fictional-gamma-mailbox"
      ],
      "limitations": [
        "APP_ID_PARAMETER_UNAVAILABLE",
        "MAILBOX_IMPACT_UNMAPPED",
        "POLICY_INPUT_INCOMPLETE",
        "POLICY_SOURCE_TIME_BOUND"
      ]
    },
    {
      "policy_model_version": "ews-policy-model/v1",
      "policy_phase": "PRE_ENFORCEMENT",
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "ews_enabled_state": "NULL",
      "app_id_list_state": "UNKNOWN",
      "membership": "UNKNOWN",
      "modeled_outcome": "CANNOT_DETERMINE",
      "rule_id": "CANNOT-APPID-PARAMETER",
      "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29",
      "evidence_ids": [
        "src-fictional-gamma-config",
        "src-fictional-gamma-mailbox"
      ],
      "limitations": [
        "APP_ID_PARAMETER_UNAVAILABLE",
        "MAILBOX_IMPACT_UNMAPPED",
        "POLICY_INPUT_INCOMPLETE",
        "POLICY_SOURCE_TIME_BOUND"
      ]
    }
  ],
  "mailbox_override_summary": {
    "tenant_key": "fictional-gamma",
    "evidence_status": "OBSERVED_COMPLETE",
    "true_count": 1,
    "false_count": 2,
    "null_count": 3,
    "total_count": 6,
    "limitations": [
      "MAILBOX_IMPACT_UNMAPPED"
    ]
  },
  "findings": [
    {
      "finding_id": "finding-fictional-gamma-00000000-0000-4000-8000-000000000031-observed_allowlist_unknown",
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "state": "OBSERVED_ALLOWLIST_UNKNOWN",
      "severity": "REVIEW",
      "explanation_code": "W_ALLOWLIST_UNKNOWN",
      "evidence_ids": [
        "src-fictional-gamma-config",
        "src-fictional-gamma-permissions",
        "src-fictional-gamma-usage"
      ],
      "limitations": [
        "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
        "APP_ID_PARAMETER_UNAVAILABLE",
        "GRAPH_EVENTUAL_CONSISTENCY",
        "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT",
        "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED",
        "USAGE_WINDOW_ONLY",
        "WEEKLY_AGGREGATION",
        "W_ALLOWLIST_UNKNOWN",
        "W_OWNER_UNKNOWN"
      ]
    }
  ],
  "decisions": [
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "decision": "investigate",
      "rationale": "fictional-gamma-reviewed",
      "owner_alias": "fictional-owner-gamma",
      "target_date": "2026-09-03",
      "review_status": "REVIEWED",
      "reviewed_by_alias": "fictional-reviewer-gamma",
      "evidence_ids": [
        "src-fictional-gamma-usage"
      ]
    }
  ],
  "configuration_proposals": [
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "current_snapshot_sha256": "5559d2e18ee12b4980f069bf248e7528f464a2e139ab0d84fa2091b1ebbdad88",
      "current_full_app_id_set": [],
      "target_state": "NO_TARGET",
      "prospective_full_app_id_set": [],
      "add_delta": [],
      "remove_delta": [],
      "current_membership": "UNKNOWN",
      "candidate_membership": "UNSPECIFIED",
      "desired_membership": "UNSPECIFIED",
      "eligibility": "BLOCKED",
      "decision": "investigate",
      "decision_review_status": "REVIEWED",
      "blocking_codes": [
        "CONFIG_EVIDENCE_INSUFFICIENT"
      ],
      "warning_codes": [
        "CURRENT_ALLOWLIST_ORIGIN_UNVERIFIED",
        "FULL_REPLACE_REVIEW_REQUIRED",
        "MAILBOX_IMPACT_UNMAPPED"
      ],
      "precondition_codes": [
        "ALL_DECISIONS_REVIEWED",
        "CURRENT_SNAPSHOT_HASH_MATCH",
        "FULL_REPLACE_REVIEW_ACK_REQUIRED"
      ],
      "review_checklist_codes": [
        "AUTHORIZE_CHANGE_OUTSIDE_PRODUCT",
        "REVIEW_ADD_DELTA",
        "REVIEW_CURRENT_FULL_SET",
        "REVIEW_LEGACY_POLICY",
        "REVIEW_MAILBOX_LIMITATIONS",
        "REVIEW_REMOVE_DELTA"
      ],
      "evidence_ids": [
        "src-fictional-gamma-config",
        "src-fictional-gamma-mailbox",
        "src-fictional-gamma-permissions",
        "src-fictional-gamma-usage"
      ]
    }
  ],
  "unknown_evidence": [
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "dimension": "APP_ID_MEMBERSHIP",
      "evidence_status": "UNAVAILABLE",
      "reason_code": "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
      "source_ref": "fictional-config",
      "limitations": [
        "ALLOWLIST_ORIGIN_NOT_OBSERVABLE",
        "APP_ID_PARAMETER_UNAVAILABLE"
      ]
    },
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "dimension": "APP_ID_PARAMETER",
      "evidence_status": "UNAVAILABLE",
      "reason_code": "APP_ID_PARAMETER_UNAVAILABLE",
      "source_ref": "fictional-config",
      "limitations": [
        "APP_ID_PARAMETER_UNAVAILABLE"
      ]
    },
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "dimension": "LEGACY_POLICY",
      "evidence_status": "UNAVAILABLE",
      "reason_code": "LEGACY_POLICY_INTERACTION_UNRESOLVED",
      "source_ref": "fictional-config",
      "limitations": [
        "LEGACY_POLICY_INTERACTION_UNRESOLVED"
      ]
    },
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "dimension": "ORGANIZATION_POLICY",
      "evidence_status": "OBSERVED_COMPLETE",
      "reason_code": "POLICY_INPUT_INCOMPLETE",
      "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29",
      "limitations": [
        "APP_ID_PARAMETER_UNAVAILABLE",
        "MAILBOX_IMPACT_UNMAPPED",
        "POLICY_INPUT_INCOMPLETE",
        "POLICY_SOURCE_TIME_BOUND"
      ]
    },
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "dimension": "OWNER_IDENTITY",
      "evidence_status": "NOT_COLLECTED",
      "reason_code": "IDENTITY_NOT_VERIFIED",
      "source_ref": "APPLICATION_CONTEXT",
      "limitations": [
        "IDENTITY_NOT_VERIFIED"
      ]
    },
    {
      "tenant_key": "fictional-gamma",
      "application_id": "00000000-0000-4000-8000-000000000031",
      "dimension": "USAGE",
      "evidence_status": "UNAVAILABLE",
      "reason_code": "USAGE_WINDOW_ONLY",
      "source_ref": "fictional-usage",
      "limitations": [
        "USAGE_WINDOW_ONLY",
        "WEEKLY_AGGREGATION"
      ]
    }
  ],
  "unknown_owners": []
}