{
  "scope": "Illustrative application predicate only; identity supplied by trusted context",
  "cases": [
    {
      "case": "original-active",
      "allow": true,
      "expected": true
    },
    {
      "case": "disabled-route",
      "allow": false,
      "expected": false
    },
    {
      "case": "removed-binding",
      "allow": false,
      "expected": false
    },
    {
      "case": "new-owner-awaiting-proof",
      "allow": false,
      "expected": false
    },
    {
      "case": "old-proof-new-owner",
      "allow": false,
      "expected": false
    },
    {
      "case": "fresh-proof-wrong-tenant",
      "allow": false,
      "expected": false
    },
    {
      "case": "fresh-proof-matching-owner",
      "allow": true,
      "expected": true
    },
    {
      "case": "foreign-requester",
      "allow": false,
      "expected": false
    }
  ],
  "allowed": 2,
  "denied": 6,
  "not_tested": [
    "DNS propagation",
    "provider hostname deletion",
    "certificate cleanup",
    "real authorization"
  ],
  "assertions": "passed"
}