{
  "ok": true,
  "tool": "api_access_check",
  "report": {
    "proven": true,
    "specError": null,
    "findings": [
      {
        "package": "Yichus/Examples/SupportAccess",
        "binding": "view_case",
        "resource": "support_cases",
        "operation": "db_read_opt",
        "kind": "GuardedRead",
        "status": "holds",
        "detail": "rows of \"support_cases\" are tainted from here; every use must sit under owns_case"
      },
      {
        "package": "Yichus/Examples/SupportAccess",
        "binding": "reply_to_case",
        "resource": "support_cases",
        "operation": "db_read_opt",
        "kind": "GuardedRead",
        "status": "holds",
        "detail": "rows of \"support_cases\" are tainted from here; every use must sit under owns_case"
      },
      {
        "package": "Yichus/Examples/SupportAccess",
        "binding": "reply_to_case",
        "resource": "support_cases",
        "operation": "db_write",
        "kind": "GuardProven",
        "status": "holds",
        "detail": "dominated by owns_case(Principal.user_id, row of support_cases), on the row it was applied to (key case_id)"
      },
      {
        "package": "Yichus/Examples/SupportAccess",
        "binding": "load_for_staff",
        "resource": "support_cases",
        "operation": "db_read_opt",
        "kind": "RoleAuthorityProven",
        "status": "holds",
        "detail": "every route reaching this binding requires every role (support)"
      },
      {
        "package": "Yichus/Examples/SupportAccess",
        "binding": "resolve_case",
        "resource": "support_cases",
        "operation": "db_read_opt",
        "kind": "RoleAuthorityProven",
        "status": "holds",
        "detail": "every route reaching this binding requires every role (support)"
      },
      {
        "package": "Yichus/Examples/SupportAccess",
        "binding": "resolve_case",
        "resource": "support_cases",
        "operation": "db_write",
        "kind": "RoleAuthorityProven",
        "status": "holds",
        "detail": "every route reaching this binding requires every role (support)"
      }
    ],
    "resources": [
      {
        "resource": "support_cases",
        "policy": "GuardedOrRoles(owns_case; requires support)",
        "status": "holds",
        "proven": true,
        "findings": [
          {
            "package": "Yichus/Examples/SupportAccess",
            "binding": "view_case",
            "resource": "support_cases",
            "operation": "db_read_opt",
            "kind": "GuardedRead",
            "status": "holds",
            "detail": "rows of \"support_cases\" are tainted from here; every use must sit under owns_case"
          },
          {
            "package": "Yichus/Examples/SupportAccess",
            "binding": "reply_to_case",
            "resource": "support_cases",
            "operation": "db_read_opt",
            "kind": "GuardedRead",
            "status": "holds",
            "detail": "rows of \"support_cases\" are tainted from here; every use must sit under owns_case"
          },
          {
            "package": "Yichus/Examples/SupportAccess",
            "binding": "reply_to_case",
            "resource": "support_cases",
            "operation": "db_write",
            "kind": "GuardProven",
            "status": "holds",
            "detail": "dominated by owns_case(Principal.user_id, row of support_cases), on the row it was applied to (key case_id)"
          },
          {
            "package": "Yichus/Examples/SupportAccess",
            "binding": "load_for_staff",
            "resource": "support_cases",
            "operation": "db_read_opt",
            "kind": "RoleAuthorityProven",
            "status": "holds",
            "detail": "every route reaching this binding requires every role (support)"
          },
          {
            "package": "Yichus/Examples/SupportAccess",
            "binding": "resolve_case",
            "resource": "support_cases",
            "operation": "db_read_opt",
            "kind": "RoleAuthorityProven",
            "status": "holds",
            "detail": "every route reaching this binding requires every role (support)"
          },
          {
            "package": "Yichus/Examples/SupportAccess",
            "binding": "resolve_case",
            "resource": "support_cases",
            "operation": "db_write",
            "kind": "RoleAuthorityProven",
            "status": "holds",
            "detail": "every route reaching this binding requires every role (support)"
          }
        ]
      }
    ]
  }
}