{
  "artifact": "probe-result",
  "artifact_version": "0.1",
  "probe_id": "probe-ars-01-identity-propagation",
  "control_id": "ARS-01",
  "citation_id": "ARS-1.0-01",
  "target": {
    "target_id": "reference-agent-hardened",
    "kind": "local_reference_agent",
    "config_name": "hardened",
    "contract_hash": null
  },
  "correlation_id": "run-3",
  "outcome": "pass",
  "evidence_status": "runtime_verified",
  "completeness": "complete",
  "observations": [
    {
      "observation_id": "ars01.principal",
      "what": "The principal attached to each downstream call",
      "value": [
        {
          "kind": "end_user",
          "id": "dana.okafor@example.invalid",
          "tenant": "tenant-a"
        }
      ],
      "derivation": "direct",
      "confidence": "high",
      "source": "audit correlation_id=run-3"
    },
    {
      "observation_id": "ars01.session-user",
      "what": "The user the session was opened as",
      "value": "dana.okafor@example.invalid",
      "derivation": "direct",
      "confidence": "high",
      "source": null
    },
    {
      "observation_id": "ars01.conclusion",
      "what": "Every observed downstream call carried the originating user",
      "value": {
        "carriesUser": true,
        "distinct_principals": [
          "end_user"
        ]
      },
      "derivation": "inferred",
      "confidence": "medium",
      "source": null
    }
  ],
  "what_this_does_not_prove": [
    "That the downstream system enforces anything on the principal it receives. This observes what the agent sends, not what the receiver does with it.",
    "That every call path propagates identity. One message plans one call; a path this scenario does not reach is unobserved, not clean.",
    "Anything about a production deployment. The target is a local deterministic fixture whose principal logic is a single branch."
  ],
  "diagnostics": [],
  "cleanup": {
    "ran": true,
    "released": [],
    "error": null
  },
  "volatile": {
    "executed_at": "2026-08-06T15:26:40.425Z",
    "duration_ms": 25.1405,
    "target_origin": "http://127.0.0.1:55797"
  },
  "canonical_hash": "15859fd9eb54beaefcecc806fde8e1b0acc2805e772178169fd73d4ccb1140e1"
}