01-happy-path

Approved request, evidence recorded

Happy path: valid JWT, allowed everything

Valid JWT with correct issuer, audience, scopes, and home_region. Request body uses an allowed model for an allowed tenant.

happy-pathallow

FIXTURE

tenant_id"acme-turkiye"

home_region"tst"

scopes

ai.chat.write

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME

HTTP STATUS200

X-POLICY-DECISIONallow

X-POLICY-REASON<empty>

OPA EXPECTATION

OPA.ALLOWtrue

DENY_REASON<null>

DENY_CATEGORY<null>

What this demonstrates

A permitted AI request passes every policy check and executes — and the decision is still recorded and signed. Compliance isn't only about blocking: every allowed action carries proof it was allowed.

EU AI Act Art. 12 (record-keeping)

RUNNER

Execute scenario

Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.

Requires the PolicyGate stack reachable on host ports 10000 / 8181.

WHY THIS MATTERS

Baseline. Proves the deployment correctly allows requests that pass all policy checks.