{
  "tool_id": "art-459-sod-matrix-check",
  "note": "golden_hash filled by golden-parity.test.mjs --update; output_payload filled by fill-fixture-payloads.mjs. Vector 1: no user holds a conflicting role pair -> clean. Vector 2: one user holds both roles in a ruleset pair -> single conflict. Vector 3: two users each hold a different conflicting pair -> two conflicts.",
  "vectors": [
    {
      "name": "clean_no_conflicts",
      "description": "AP entry and AP approval are split across two users -- no role pair in any single user's assignment matches the ruleset.",
      "policy_parameters": {
        "ruleset_version": "sod-ruleset-v1",
        "conflict_ruleset": [
          {
            "role_a": "AP_ENTRY",
            "role_b": "AP_APPROVE",
            "reason_code": "SOD_AP_ENTRY_APPROVE"
          }
        ],
        "assignments": [
          {
            "user_id": "u1",
            "roles": [
              "AP_ENTRY"
            ]
          },
          {
            "user_id": "u2",
            "roles": [
              "AP_APPROVE"
            ]
          }
        ]
      },
      "output_payload": {
        "ruleset_version": "sod-ruleset-v1",
        "users_evaluated": 2,
        "conflict_rules_evaluated": 1,
        "conflicts": [],
        "conflict_count": 0,
        "users_with_conflicts": 0,
        "clean": true
      },
      "golden_hash": "14f1ae41bc6ad1a6ed9c884a93da262871fe845bf60c46ce9268123884defde2"
    },
    {
      "name": "single_conflict",
      "description": "One user holds both AP_ENTRY and AP_APPROVE -- a single SoD conflict.",
      "policy_parameters": {
        "ruleset_version": "sod-ruleset-v1",
        "conflict_ruleset": [
          {
            "role_a": "AP_ENTRY",
            "role_b": "AP_APPROVE",
            "reason_code": "SOD_AP_ENTRY_APPROVE"
          }
        ],
        "assignments": [
          {
            "user_id": "u3",
            "roles": [
              "AP_ENTRY",
              "AP_APPROVE"
            ]
          }
        ]
      },
      "output_payload": {
        "ruleset_version": "sod-ruleset-v1",
        "users_evaluated": 1,
        "conflict_rules_evaluated": 1,
        "conflicts": [
          {
            "user_id": "u3",
            "role_a": "AP_APPROVE",
            "role_b": "AP_ENTRY",
            "reason_code": "SOD_AP_ENTRY_APPROVE"
          }
        ],
        "conflict_count": 1,
        "users_with_conflicts": 1,
        "clean": false
      },
      "golden_hash": "d417b2dd3e5d3923edb32475ce07a7a0969fc44e5fab85cd6f74e714de4ffc94"
    },
    {
      "name": "multi_user_multi_conflict",
      "description": "Two independent conflict rules, each violated by a different user -- two conflicts, two distinct users flagged.",
      "policy_parameters": {
        "ruleset_version": "sod-ruleset-v2",
        "conflict_ruleset": [
          {
            "role_a": "AP_ENTRY",
            "role_b": "AP_APPROVE",
            "reason_code": "SOD_AP_ENTRY_APPROVE"
          },
          {
            "role_a": "VENDOR_MASTER_EDIT",
            "role_b": "AP_APPROVE",
            "reason_code": "SOD_VENDOR_MASTER_AP_APPROVE"
          }
        ],
        "assignments": [
          {
            "user_id": "u4",
            "roles": [
              "AP_ENTRY",
              "AP_APPROVE"
            ]
          },
          {
            "user_id": "u5",
            "roles": [
              "VENDOR_MASTER_EDIT",
              "AP_APPROVE"
            ]
          },
          {
            "user_id": "u6",
            "roles": [
              "AP_ENTRY"
            ]
          }
        ]
      },
      "output_payload": {
        "ruleset_version": "sod-ruleset-v2",
        "users_evaluated": 3,
        "conflict_rules_evaluated": 2,
        "conflicts": [
          {
            "user_id": "u4",
            "role_a": "AP_APPROVE",
            "role_b": "AP_ENTRY",
            "reason_code": "SOD_AP_ENTRY_APPROVE"
          },
          {
            "user_id": "u5",
            "role_a": "AP_APPROVE",
            "role_b": "VENDOR_MASTER_EDIT",
            "reason_code": "SOD_VENDOR_MASTER_AP_APPROVE"
          }
        ],
        "conflict_count": 2,
        "users_with_conflicts": 2,
        "clean": false
      },
      "golden_hash": "5eaef40a978a029c297b4f952333cd81de096d69d950d5d185c69116e48b5a5f"
    }
  ]
}