# grantdecay access log export, test vector.
# Format:
#   window <start> <end>          required first record, ISO-8601 dates
#   <date> <principal> <permission>   one access event, date inside the window
#
# The window is 31 days, one day over the default 30 day minimum, so the run is
# conclusive and absence-based findings are produced.

window 2026-06-01 2026-07-01

# svc-web exercises push, promote, and both reads. It never exercises
# deploy:rollback, which becomes an unused permission and makes deploy narrowable.
2026-06-02 svc-web deploy:push
2026-06-05 svc-web deploy:promote
2026-06-09 svc-web repo:read
2026-06-11 svc-web logs:read
2026-06-20 svc-web deploy:push
2026-06-28 svc-web deploy:promote

# svc-batch records no events at all: it is fully dormant.

# svc-finance exercises both billing permissions, so the billing role stays in
# use and is not narrowable.
2026-06-04 svc-finance billing:view
2026-06-18 svc-finance billing:export
2026-06-29 svc-finance billing:view

# svc-oncall exercises everything it holds, plus repo:read which it was never
# granted. repo:read surfaces as ungranted use.
2026-06-03 svc-oncall incident:ack
2026-06-07 svc-oncall logs:read
2026-06-15 svc-oncall repo:read
2026-06-27 svc-oncall incident:ack
