# grantdecay entitlement export, test vector.
# Format:
#   role  <role_name> <permission> [<permission> ...]
#   grant <principal>  <role_name> [<role_name> ...]
#
# Roles confer permissions. Grants assign roles to principals.

# The deploy role confers three permissions. rollback is never exercised by any
# holder in the sample log, so this role is narrowable.
role deploy   deploy:push deploy:promote deploy:rollback

# The read role confers two read permissions.
role read     repo:read logs:read

# The billing role confers billing actions. svc-finance exercises both, so the
# role itself is not narrowable even though svc-batch holds it while dormant.
role billing  billing:view billing:export

# The oncall role confers an incident action plus a read.
role oncall   incident:ack logs:read

# svc-web deploys and reads. It exercises most, leaving one unused permission.
grant svc-web    deploy read

# svc-batch is granted billing but never does anything in the window: fully
# dormant.
grant svc-batch  billing

# svc-finance holds billing and exercises both billing permissions, keeping the
# billing role in active use.
grant svc-finance billing

# svc-oncall handles incidents. It also exercises a permission it was never
# granted (repo:read), which the log will reveal as ungranted use.
grant svc-oncall oncall
