06-jwt-expired
Stale credentials used
Expired JWT
JWT with exp in the past. The gateway's credential check rejects the request before policy evaluation runs.
jwtdenyexpired
FIXTURE
tenant_id"acme-turkiye"
home_region"tst"
scopes
ai.chat.write
exp1000000000
iat999999000
Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256
EXPECTED OUTCOME
HTTP STATUS401
POLICY ENGINE NOT CONSULTEDREJECTED AT THE GATEWAY BEFORE POLICY EVALUATION
What this demonstrates
A request arrives with expired credentials. Expired-credential acceptance is how leaked old tokens become breaches; here it's refused before the AI ever runs.
Identity & access management
RUNNER
Execute scenario
Mints a JWT, sends the request through the live gateway, and compares the response against the expected outcome.
Requires the PolicyGate stack reachable on host ports 10000 / 8181.
WHY THIS MATTERS
Proves the JWT verification gate enforces token expiry.