{
  "capabilities": [
    [
      "read_slice",
      "Read supplied artifact slice"
    ],
    [
      "read_case",
      "Read case evidence, claims, candidates"
    ],
    [
      "write_claims",
      "Write proposed claims + diagnostics"
    ],
    [
      "write_recommendation",
      "Write recommendation"
    ],
    [
      "accept",
      "Accept facts / auto-accept"
    ],
    [
      "decide",
      "Decide review cases"
    ],
    [
      "publish",
      "Publish events"
    ],
    [
      "secrets",
      "Read secrets / credentials"
    ],
    [
      "fetch",
      "Fetch URLs / network"
    ],
    [
      "db",
      "Direct database access"
    ]
  ],
  "rows": [
    {
      "actor": "act_llm_extractor",
      "status": "EST",
      "cells": {
        "read_slice": "allow",
        "read_case": "deny",
        "write_claims": "allow",
        "write_recommendation": "deny",
        "accept": "deny",
        "decide": "deny",
        "publish": "deny",
        "secrets": "deny",
        "fetch": "deny",
        "db": "deny"
      }
    },
    {
      "actor": "act_llm_reviewer",
      "status": "EST",
      "cells": {
        "read_slice": "limited",
        "read_case": "allow",
        "write_claims": "deny",
        "write_recommendation": "allow",
        "accept": "deny",
        "decide": "deny",
        "publish": "deny",
        "secrets": "deny",
        "fetch": "deny",
        "db": "deny"
      }
    }
  ],
  "notes": [
    "EST|Neither actor can accept, decide, publish, read secrets or fetch URLs",
    "PROP|\"limited\": the reviewer sees the slices already attached to the case, not arbitrary artifacts",
    "PROP|Enforced structurally: actors receive a prepared input bundle and return a value; they hold no credentials and no database or network handles. The adapter calling the model provider holds the provider key, not the actor prompt",
    "PROP|Output schema validation + citation check happen in the calling module before anything is stored"
  ]
}