{
  "contract": "urn:xproject:application-initial-admin-candidate:v1",
  "purpose": "An app-scoped, signed OIDC decision for a consumer's first local PLATFORM_ADMIN mapping.",
  "configuration": {
    "default": "no candidates",
    "selectors": ["stable person", "controlled person admission group"],
    "prohibited": ["free-text IDs", "global roles", "business roles"]
  },
  "signedAccessTokenClaim": "urn:xproject:application-initial-admin-candidate:v1",
  "requiredFields": ["contract", "applicationId", "stableExternalPersonId", "evaluatedAt", "decisionId", "policyVersion", "applicationAdmission", "initialPlatformAdminCandidate", "deviceAdmission"],
  "states": {
    "applicationAdmission": ["ADMITTED", "NOT_ADMITTED"],
    "initialPlatformAdminCandidate": ["ELIGIBLE", "NOT_ELIGIBLE"],
    "deviceAdmission": ["REQUIRED", "NOT_REQUIRED"]
  },
  "consumerRules": [
    "verify signature, issuer, audience and time claims",
    "use stableExternalPersonId only for the consumer-local PLATFORM_ADMIN mapping",
    "never treat NOT_REQUIRED as device-agent admission",
    "do not report first binding completion back to X-Project"
  ]
}