diff --git a/docs/action-dispatch-matrix.json b/docs/action-dispatch-matrix.json
index 5cdd2ef2..14cc6ea4 100644
--- a/docs/action-dispatch-matrix.json
+++ b/docs/action-dispatch-matrix.json
@@ -1,8 +1,12 @@
 {
   "protocol": "aml-action-dispatch-matrix/1",
   "provenance": "project-authored bounded cross-product of local callbacks",
-  "limits": "192 finite combinations. No human approval, provider call, delivery, arbitrary interleaving, or production safety proof.",
+  "limits": "384 finite combinations. No human approval, provider call, delivery, arbitrary interleaving, or production safety proof.",
   "axes": {
+    "resource_scope": [
+      "exact",
+      "other"
+    ],
     "policy": [
       "deny",
       "allow",
@@ -30,6 +34,9 @@
   },
   "rows": [
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "accept",
@@ -51,6 +58,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "accept",
@@ -72,6 +82,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "refuse",
@@ -93,6 +106,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "refuse",
@@ -114,6 +130,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -135,6 +154,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -156,6 +178,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -177,6 +202,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -198,6 +226,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "accept",
@@ -219,6 +250,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "accept",
@@ -240,6 +274,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "refuse",
@@ -261,6 +298,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "refuse",
@@ -282,6 +322,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -303,6 +346,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -324,6 +370,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -345,6 +394,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -366,6 +418,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "accept",
@@ -387,6 +442,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "accept",
@@ -408,6 +466,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "refuse",
@@ -429,6 +490,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "refuse",
@@ -450,6 +514,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -471,6 +538,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -492,6 +562,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -513,6 +586,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -534,6 +610,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "accept",
@@ -555,6 +634,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "accept",
@@ -576,6 +658,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "refuse",
@@ -597,6 +682,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "refuse",
@@ -618,6 +706,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -639,6 +730,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -660,6 +754,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -681,6 +778,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -702,6 +802,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "accept",
@@ -723,6 +826,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "accept",
@@ -744,6 +850,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "refuse",
@@ -765,6 +874,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "refuse",
@@ -786,6 +898,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -807,6 +922,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -828,6 +946,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -849,6 +970,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -870,6 +994,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -891,6 +1018,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -912,6 +1042,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -933,6 +1066,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -954,6 +1090,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -975,6 +1114,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -996,6 +1138,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -1017,6 +1162,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": null,
       "policy": "deny",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -1038,6 +1186,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "accept",
@@ -1059,6 +1210,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "accept",
@@ -1080,6 +1234,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "refuse",
@@ -1101,6 +1258,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "refuse",
@@ -1122,6 +1282,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -1143,6 +1306,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -1164,6 +1330,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -1185,6 +1354,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -1206,6 +1378,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "accept",
@@ -1227,6 +1402,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "accept",
@@ -1248,6 +1426,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "refuse",
@@ -1269,6 +1450,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "refuse",
@@ -1290,6 +1474,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -1311,6 +1498,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -1332,6 +1522,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -1353,6 +1546,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -1374,6 +1570,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "accept",
@@ -1395,6 +1594,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "accept",
@@ -1416,6 +1618,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "refuse",
@@ -1437,6 +1642,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "refuse",
@@ -1458,6 +1666,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -1479,6 +1690,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -1500,6 +1714,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -1521,6 +1738,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -1542,6 +1762,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "accept",
@@ -1563,6 +1786,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "accept",
@@ -1584,6 +1810,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "refuse",
@@ -1605,6 +1834,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "refuse",
@@ -1626,6 +1858,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -1647,6 +1882,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -1668,6 +1906,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -1689,6 +1930,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -1710,6 +1954,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "accept",
@@ -1731,6 +1978,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "accept",
@@ -1752,6 +2002,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "refuse",
@@ -1773,6 +2026,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "refuse",
@@ -1794,6 +2050,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -1815,6 +2074,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -1836,6 +2098,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -1857,6 +2122,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -1878,6 +2146,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -1899,6 +2170,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -1920,6 +2194,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -1941,6 +2218,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -1962,6 +2242,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -1983,6 +2266,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -2004,6 +2290,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -2025,6 +2314,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "allow",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -2046,6 +2338,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "accept",
@@ -2067,6 +2362,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "accept",
@@ -2088,6 +2386,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "refuse",
@@ -2109,6 +2410,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "refuse",
@@ -2130,6 +2434,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -2151,6 +2458,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -2172,6 +2482,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -2193,6 +2506,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -2214,6 +2530,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "accept",
@@ -2235,6 +2554,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "accept",
@@ -2256,6 +2578,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "refuse",
@@ -2277,6 +2602,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "refuse",
@@ -2298,6 +2626,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -2319,6 +2650,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -2340,6 +2674,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -2361,6 +2698,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -2382,6 +2722,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "accept",
@@ -2403,6 +2746,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "accept",
@@ -2424,6 +2770,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "refuse",
@@ -2445,6 +2794,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "refuse",
@@ -2466,6 +2818,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -2487,6 +2842,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -2508,6 +2866,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -2529,6 +2890,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -2550,6 +2914,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "accept",
@@ -2571,6 +2938,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "accept",
@@ -2592,6 +2962,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "refuse",
@@ -2613,6 +2986,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "refuse",
@@ -2634,6 +3010,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -2655,6 +3034,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -2676,6 +3058,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -2697,6 +3082,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -2718,6 +3106,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "accept",
@@ -2739,6 +3130,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "accept",
@@ -2760,6 +3154,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "refuse",
@@ -2781,6 +3178,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "refuse",
@@ -2802,6 +3202,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -2823,6 +3226,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -2844,6 +3250,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -2865,6 +3274,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -2886,6 +3298,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -2907,6 +3322,9 @@
       "result_target": "team@example.test"
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -2928,6 +3346,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -2949,6 +3370,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -2970,6 +3394,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -2991,6 +3418,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -3012,6 +3442,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -3033,6 +3466,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "requires_approval",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -3054,6 +3490,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "accept",
@@ -3075,6 +3514,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "accept",
@@ -3096,6 +3538,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "refuse",
@@ -3117,6 +3562,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "refuse",
@@ -3138,6 +3586,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -3159,6 +3610,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "throw_after_consume",
@@ -3180,6 +3634,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -3201,6 +3658,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "match",
       "claim": "revoke_after_consume",
@@ -3222,6 +3682,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "accept",
@@ -3243,6 +3706,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "accept",
@@ -3264,6 +3730,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "refuse",
@@ -3285,6 +3754,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "refuse",
@@ -3306,6 +3778,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -3327,6 +3802,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "throw_after_consume",
@@ -3348,6 +3826,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -3369,6 +3850,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "decline",
       "claim": "revoke_after_consume",
@@ -3390,6 +3874,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "accept",
@@ -3411,6 +3898,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "accept",
@@ -3432,6 +3922,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "refuse",
@@ -3453,6 +3946,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "refuse",
@@ -3474,6 +3970,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -3495,6 +3994,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "throw_after_consume",
@@ -3516,6 +4018,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -3537,6 +4042,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mismatch",
       "claim": "revoke_after_consume",
@@ -3558,6 +4066,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "accept",
@@ -3579,6 +4090,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "accept",
@@ -3600,6 +4114,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "refuse",
@@ -3621,6 +4138,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "refuse",
@@ -3642,6 +4162,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -3663,6 +4186,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "throw_after_consume",
@@ -3684,6 +4210,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -3705,6 +4234,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "throw",
       "claim": "revoke_after_consume",
@@ -3726,6 +4258,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "accept",
@@ -3747,6 +4282,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "accept",
@@ -3768,6 +4306,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "refuse",
@@ -3789,6 +4330,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "refuse",
@@ -3810,6 +4354,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -3831,6 +4378,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "throw_after_consume",
@@ -3852,6 +4402,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -3873,6 +4426,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "revoke",
       "claim": "revoke_after_consume",
@@ -3894,6 +4450,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -3915,6 +4474,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "accept",
@@ -3936,6 +4498,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -3957,6 +4522,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "refuse",
@@ -3978,6 +4546,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -3999,6 +4570,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "throw_after_consume",
@@ -4020,6 +4594,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -4041,6 +4618,9 @@
       "result_target": null
     },
     {
+      "resource_scope": "exact",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "team@example.test",
       "policy": "ambiguous",
       "approval": "mutate_caller",
       "claim": "revoke_after_consume",
@@ -4060,6 +4640,4614 @@
       "callback_target": null,
       "caller_target_after": "team@example.test",
       "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "deny",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "allow",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "requires_approval",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "match",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "decline",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mismatch",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "throw",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "revoke",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "accept",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "refuse",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "throw_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "return",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
+    },
+    {
+      "resource_scope": "other",
+      "proposal_resource": "team@example.test",
+      "policy_rule_resource": "outside@example.test",
+      "policy": "ambiguous",
+      "approval": "mutate_caller",
+      "claim": "revoke_after_consume",
+      "callback": "throw_after_write",
+      "receipt": {
+        "protocol": "aml-action-dispatch/1",
+        "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+        "policy_decision": "deny",
+        "execution_status": "blocked",
+        "reason": "no_exact_rule"
+      },
+      "approval_requests": 0,
+      "claim_attempts": 0,
+      "claims_consumed": 0,
+      "callback_count": 0,
+      "fixture_writes": 0,
+      "callback_target": null,
+      "caller_target_after": "team@example.test",
+      "result_target": null
     }
   ]
 }
diff --git a/docs/action-dispatch-mutants.json b/docs/action-dispatch-mutants.json
index 0db43632..93cdd8ed 100644
--- a/docs/action-dispatch-mutants.json
+++ b/docs/action-dispatch-mutants.json
@@ -3,8 +3,8 @@
   "provenance": "project-authored exact source substitutions and local callbacks",
   "limits": "Selected mutations and finite fixtures only. No external side effect, arbitrary bug coverage, outside witness, or formal proof of production safety.",
   "boundary_source_sha256": "4a7d72c4df073c669312f614cad109ea487772c852e4cb00880e566fc9ad329f",
-  "matrix_report_sha256": "3622583d7f5184e43824c3976a589425f9264b8d3e25ae2c9a784841b8d70fa9",
-  "matrix_vectors": 192,
+  "matrix_report_sha256": "2ccdb17341e4406960ec8e6f519d3d1a5dca7f8a4efa8a57d5c9b1b5c0b7c075",
+  "matrix_vectors": 384,
   "resource_probe_reference": {
     "execution_status": "blocked",
     "reason": "no_exact_rule",
@@ -13,8 +13,8 @@
   },
   "summary": {
     "selected_mutants": 7,
-    "matrix_detected": 6,
-    "additional_probe_detected": 1,
+    "matrix_detected": 7,
+    "additional_probe_detected": 0,
     "undetected": 0
   },
   "mutations": [
@@ -25,12 +25,15 @@
       "first_changed_vector": {
         "index": 112,
         "axes": {
+          "resource_scope": "exact",
           "policy": "requires_approval",
           "approval": "mismatch",
           "claim": "accept",
           "callback": "return"
         },
         "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -48,6 +51,8 @@
           "result_target": null
         },
         "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -80,12 +85,15 @@
       "first_changed_vector": {
         "index": 96,
         "axes": {
+          "resource_scope": "exact",
           "policy": "requires_approval",
           "approval": "match",
           "claim": "accept",
           "callback": "return"
         },
         "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -103,6 +111,8 @@
           "result_target": "team@example.test"
         },
         "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -135,12 +145,15 @@
       "first_changed_vector": {
         "index": 128,
         "axes": {
+          "resource_scope": "exact",
           "policy": "requires_approval",
           "approval": "revoke",
           "claim": "accept",
           "callback": "return"
         },
         "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -158,6 +171,8 @@
           "result_target": null
         },
         "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -190,12 +205,15 @@
       "first_changed_vector": {
         "index": 102,
         "axes": {
+          "resource_scope": "exact",
           "policy": "requires_approval",
           "approval": "match",
           "claim": "revoke_after_consume",
           "callback": "return"
         },
         "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -213,6 +231,8 @@
           "result_target": null
         },
         "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -245,12 +265,15 @@
       "first_changed_vector": {
         "index": 136,
         "axes": {
+          "resource_scope": "exact",
           "policy": "requires_approval",
           "approval": "mutate_caller",
           "claim": "accept",
           "callback": "return"
         },
         "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -268,6 +291,8 @@
           "result_target": "team@example.test"
         },
         "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -300,12 +325,15 @@
       "first_changed_vector": {
         "index": 49,
         "axes": {
+          "resource_scope": "exact",
           "policy": "allow",
           "approval": "match",
           "claim": "accept",
           "callback": "throw_after_write"
         },
         "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -323,6 +351,8 @@
           "result_target": null
         },
         "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "team@example.test",
           "receipt": {
             "protocol": "aml-action-dispatch/1",
             "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
@@ -351,8 +381,55 @@
     {
       "id": "resource_wildcard",
       "change": "Accept a policy rule for another resource",
-      "matrix_changed_rows": 0,
-      "first_changed_vector": null,
+      "matrix_changed_rows": 192,
+      "first_changed_vector": {
+        "index": 192,
+        "axes": {
+          "resource_scope": "other",
+          "policy": "deny",
+          "approval": "match",
+          "claim": "accept",
+          "callback": "return"
+        },
+        "reference": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "outside@example.test",
+          "receipt": {
+            "protocol": "aml-action-dispatch/1",
+            "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+            "policy_decision": "deny",
+            "execution_status": "blocked",
+            "reason": "no_exact_rule"
+          },
+          "approval_requests": 0,
+          "claim_attempts": 0,
+          "claims_consumed": 0,
+          "callback_count": 0,
+          "fixture_writes": 0,
+          "callback_target": null,
+          "caller_target_after": "team@example.test",
+          "result_target": null
+        },
+        "mutant": {
+          "proposal_resource": "team@example.test",
+          "policy_rule_resource": "outside@example.test",
+          "receipt": {
+            "protocol": "aml-action-dispatch/1",
+            "proposal_sha256": "2b22778cd386ab9c452f9ddf4f9f4eee57ea41a89721ac24efdf761946178813",
+            "policy_decision": "allow",
+            "execution_status": "dispatched",
+            "reason": "host_dispatch_returned"
+          },
+          "approval_requests": 0,
+          "claim_attempts": 0,
+          "claims_consumed": 0,
+          "callback_count": 1,
+          "fixture_writes": 0,
+          "callback_target": "team@example.test",
+          "caller_target_after": "team@example.test",
+          "result_target": "team@example.test"
+        }
+      },
       "resource_probe_changed": true,
       "resource_probe_result": {
         "execution_status": "dispatched",
diff --git a/docs/dispatch-matrix.html b/docs/dispatch-matrix.html
index af27dc20..16d663ab 100644
--- a/docs/dispatch-matrix.html
+++ b/docs/dispatch-matrix.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <meta name="theme-color" content="#091622">
-  <meta name="description" content="Explore 192 local action dispatch vectors, including blocked spent claims, frozen targets, and uncertain callback outcomes.">
+  <meta name="description" content="Explore 384 local action dispatch vectors across exact and mismatched resource rules, approval, claims, and callback outcomes.">
   <title>The dispatch proof atlas · ĀML™</title>
   <style>
     :root{color-scheme:dark;--bg:#091622;--surface:#112536;--surface2:#0d2030;--line:#3e6271;--ink:#f4f8f5;--muted:#bfd2d7;--mint:#9ef5cf;--coral:#ffada6;--amber:#f7d38b;--sky:#8bdeee}
@@ -16,6 +16,8 @@
     .board{background:#0b1d2b;border:1px solid var(--line);border-radius:24px;padding:28px;margin-bottom:28px}.board-head{display:flex;justify-content:space-between;gap:20px;align-items:end;flex-wrap:wrap}.board-head h2{font-size:clamp(2rem,3.5vw,3rem);letter-spacing:-.05em;margin:7px 0 0}.board-head p{color:var(--muted);margin:0;max-width:630px;font-size:.88rem}.filters{display:flex;gap:15px;flex-wrap:wrap;align-items:end;border-block:1px solid var(--line);padding:19px 0;margin:23px 0}.filters label{display:grid;gap:6px;color:var(--sky);font-size:.75rem;letter-spacing:.08em;font-weight:800;text-transform:uppercase;min-width:178px}.filters select{background:#0a1723;border:1px solid #6a8793;color:var(--ink);padding:10px 12px;border-radius:9px;font-size:.88rem;min-width:178px}.filters output{margin-left:auto;color:var(--muted);font-size:.83rem}.board-key{display:flex;gap:10px 19px;flex-wrap:wrap;align-items:center;margin:0 0 18px;color:var(--muted);font-size:.77rem}.key{display:inline-flex;align-items:center;gap:6px}.key i{display:inline-block;width:12px;height:12px;border-radius:4px}.key[data-status=dispatched] i,.vector[data-status=dispatched]{background:#5dd1a5}.key[data-status=unknown] i,.vector[data-status=unknown]{background:#f0bf73}.key[data-status=blocked] i,.vector[data-status=blocked]{background:#c88b95}.matrix-scroll{overflow-x:auto;padding-bottom:10px;scrollbar-color:#547786 transparent}.matrix-grid{display:grid;grid-template-columns:repeat(4,minmax(255px,1fr));gap:13px;min-width:1080px}.policy-column{border:1px solid var(--line);border-radius:14px;background:#112b3a;padding:15px}.policy-column h3{text-transform:capitalize;font-size:1.25rem;margin:0 0 12px;letter-spacing:-.025em}.approval-group{border-top:1px solid #3e6170;padding:10px 0 11px}.approval-group h4{margin:0 0 8px;text-transform:capitalize;color:#c4d9dd;font:700 .72rem ui-monospace,monospace}.cells{display:grid;grid-template-columns:repeat(8,minmax(0,1fr));gap:4px;min-height:26px}.vector{border:0;border-radius:6px;min-width:0;height:26px;color:#091622;font-weight:900;font-size:.81rem;line-height:1}.vector:hover,.vector[aria-pressed=true]{box-shadow:0 0 0 3px var(--ink),0 0 0 5px #183a48;z-index:1}.empty{grid-column:1/-1;color:#9fb2bb;font-size:.72rem}.board-foot{color:var(--muted);font-size:.78rem;margin:16px 0 0}
     .case{border:1px solid #5f888b;border-radius:24px;background:linear-gradient(135deg,#153944,#0d2332 55%,#172c38);padding:clamp(22px,4vw,42px);margin-bottom:75px;scroll-margin-top:24px}.case[hidden]{display:none}.case-top{display:flex;align-items:start;justify-content:space-between;gap:20px;flex-wrap:wrap}.case h2{font-size:clamp(1.75rem,3.1vw,3rem);line-height:1.08;letter-spacing:-.045em;margin:12px 0 10px;text-transform:capitalize}.badge{display:inline-block;font:900 .83rem ui-monospace,monospace;letter-spacing:.06em;padding:9px 13px;border-radius:7px;background:#c88b95;color:#091622}.badge[data-status=dispatched]{background:#5dd1a5}.badge[data-status=unknown]{background:#f0bf73}.reason{font:800 .78rem ui-monospace,monospace;color:var(--sky);overflow-wrap:anywhere}.case-summary{max-width:800px;color:#dce8e8;font-size:1.04rem;margin:16px 0 30px}.path{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));list-style:none;padding:0;margin:0;gap:9px}.path-item{border:1px solid var(--line);background:#091c2a;border-radius:13px;padding:16px;min-height:118px}.path-label{display:block;color:var(--sky);font:800 .68rem ui-monospace,monospace;letter-spacing:.09em}.path strong{display:block;margin-top:14px;font-size:.92rem;line-height:1.35;overflow-wrap:anywhere}.bindings{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px;margin:20px 0}.binding{border:1px solid var(--line);border-radius:12px;padding:15px 17px}.binding span{display:block;font:800 .67rem ui-monospace,monospace;letter-spacing:.1em;color:var(--muted)}.binding strong{display:block;margin-top:7px;overflow-wrap:anywhere;font-size:.93rem}.digest{color:var(--muted);font-size:.77rem;overflow-wrap:anywhere}.digest code{color:var(--sky)}.case-actions{display:flex;gap:15px;align-items:center;flex-wrap:wrap;margin-top:23px}.copy{border:1px solid var(--sky);background:#0e3540;color:var(--ink);border-radius:9px;padding:10px 15px;font-weight:800}.case-actions a{font-size:.82rem;font-weight:750}.case-actions output{color:var(--mint);font-size:.8rem}details{margin-top:17px}summary{cursor:pointer;color:var(--sky);font-size:.83rem;font-weight:750}pre{white-space:pre-wrap;overflow-wrap:anywhere;padding:18px;border-radius:11px;background:#071721;border:1px solid var(--line);font:12px/1.55 ui-monospace,monospace;max-height:440px;overflow:auto}
     .challenge{border:1px solid #8c9c7d;border-radius:24px;background:radial-gradient(circle at 94% 4%,#bd905e31,transparent 42%),linear-gradient(135deg,#203b3a,#172c35 64%,#293138);padding:clamp(25px,4vw,48px);margin:0 0 75px}.challenge-grid{display:grid;grid-template-columns:1fr 1fr;gap:clamp(25px,5vw,70px);align-items:center}.challenge h2{font-size:clamp(2.25rem,4vw,4.5rem);letter-spacing:-.06em;line-height:1.02;margin:12px 0 17px}.challenge p{color:#dce6e3;margin:0 0 17px;max-width:590px}.challenge a{font-weight:800}.challenge-signal{border-left:2px solid var(--amber);padding-left:24px}.challenge-numbers{display:flex;gap:16px;margin-bottom:22px}.challenge-numbers div{flex:1;border:1px solid #71827e;background:#102936b8;border-radius:15px;padding:16px}.challenge-numbers strong{display:block;font-size:clamp(2.4rem,5vw,4.5rem);letter-spacing:-.08em;line-height:1;color:var(--mint)}.challenge-numbers div:last-child strong{color:var(--amber)}.challenge-numbers span{display:block;margin-top:7px;color:#d0dddd;font:.77rem/1.35 ui-monospace,monospace}.challenge-signal p{font-size:.91rem;margin-bottom:0}.method{border-top:1px solid var(--line);padding:35px 0 60px;display:grid;grid-template-columns:.8fr 1.2fr;gap:30px}.method h2{margin:0;font-size:clamp(1.9rem,3vw,2.7rem);letter-spacing:-.04em}.method p{color:var(--muted);margin:0 0 14px}.method code{color:var(--mint);overflow-wrap:anywhere}.method a{font-weight:700}.foot{border-top:1px solid var(--line);padding:25px 0 55px;color:var(--muted);font-size:.78rem}
+    .lenses{grid-template-columns:repeat(4,minmax(0,1fr))}.scope-lane{margin:7px 0 12px}.scope-lane:last-child{margin-bottom:0}.scope-label{display:block;color:#a8cad2;font:700 .65rem ui-monospace,monospace;letter-spacing:.05em;margin:0 0 5px;text-transform:uppercase}.scope-lane[data-scope=other] .scope-label{color:var(--amber)}.challenge-numbers div:last-child strong{color:var(--amber)}
+    @media(max-width:1100px){.lenses{grid-template-columns:repeat(2,minmax(0,1fr))}}
     @media(max-width:850px){.hero{grid-template-columns:1fr;gap:25px;padding:50px 0}.totals{grid-template-columns:repeat(2,1fr)}.lenses{grid-template-columns:1fr}.lens{min-height:0}.path{grid-template-columns:repeat(2,1fr)}.challenge-grid,.method{grid-template-columns:1fr}}
     @media(max-width:520px){.wrap{width:min(100% - 28px,1300px)}.top{align-items:flex-start;flex-direction:column}.top nav{gap:11px}.hero{padding-top:43px}.hero h1{font-size:clamp(3.55rem,15vw,5.8rem)}.hero-aside{padding-left:16px}.totals{gap:7px;margin-bottom:55px}.total{padding:16px;min-height:127px}.total strong{font-size:2.7rem}.section-heading{display:block}.section-heading p{margin-top:13px}.board{padding:17px}.filters label,.filters select{flex:1;min-width:135px}.filters output{width:100%;margin-left:0}.path,.bindings{grid-template-columns:1fr}.path-item{min-height:0}.case{margin-bottom:55px}}
     .cell-placeholder{height:26px;border:1px dashed #426170;border-radius:6px;opacity:.55}
@@ -26,15 +28,15 @@
   <div class="wrap">
     <header class="top"><a class="brand" href="index.html">ĀML™ / ĀRU INTELLIGENCE</a><nav aria-label="Site"><a href="agent-start.html">Agent tool guide</a><a href="action-boundary-studio.html">Boundary Studio</a><a href="https://github.com/aruintelligence/aml-core/tree/main/pilots/action-boundary">Source ↗</a></nav></header>
     <main>
-      <section class="hero" aria-labelledby="title"><div><div class="eyebrow">ENGINEERING EVIDENCE / LOCAL DISPATCH</div><h1 id="title">The dispatch <span>proof atlas.</span></h1><p class="lead">One host boundary. Four policy states, six approval behaviors, four claim behaviors, two callback outcomes. Explore every recorded combination, then inspect the receipt and the local effects that led to it.</p></div><aside class="hero-aside"><strong>One case is a snapshot.<br>192 cases reveal the edges.</strong><p id="source-state" role="status" aria-live="polite">Loading the checked-in matrix…</p><a href="action-dispatch-matrix.json">Download the full report ↗</a></aside></section>
-      <section class="totals" aria-label="Recorded local results"><div class="total"><span>CALLBACK RETURNED</span><strong id="count-dispatched">—</strong><p>Dispatched in a local fixture</p></div><div class="total"><span>CALLBACK THREW</span><strong id="count-unknown">—</strong><p>May follow a local write</p></div><div class="total"><span>STOPPED BEFORE CALLBACK</span><strong id="count-blocked">—</strong><p>Claim may still be consumed</p></div><div class="total"><span>FINITE COMBINATIONS</span><strong>192</strong><p>Exhaustive only over these axes</p></div></section>
-      <section aria-labelledby="lenses-title"><div class="section-heading"><div><div class="eyebrow">THREE IMPORTANT EDGES</div><h2 id="lenses-title">What a receipt hides.</h2></div><p>These counts describe the finite matrix, not a production rate. Each card opens one exact example below.</p></div><div class="lenses"><button type="button" class="lens" data-preset="100"><small id="insight-spent_and_blocked">LOADING / SPENT BEFORE DISPATCH</small><strong>Blocked, but the claim is gone.</strong><span>The claim hook consumes a one-use grant, then throws. The callback stays untouched; the grant is still spent. ↗</span></button><button type="button" class="lens" data-preset="49"><small id="insight-unknown_after_write">LOADING / UNCERTAIN OUTCOME</small><strong>Unknown after a local write.</strong><span>A callback writes a marker, then throws. The receipt cannot turn that into proof of no effect. ↗</span></button><button type="button" class="lens" data-preset="136"><small id="insight-frozen_after_mutation">LOADING / FROZEN DESTINATION</small><strong>The caller changes; the target does not.</strong><span>During approval the caller mutates its object. The callback still receives the original canonical destination. ↗</span></button></div></section>
-      <section class="board" aria-labelledby="board-title"><div class="board-head"><div><div class="eyebrow">THE COMPLETE CROSS-PRODUCT</div><h2 id="board-title">Every local path.</h2></div><p>Each square is one vector. Columns are policy states; rows are approval-hook behaviors. In each row, squares follow the four claim behaviors, with a returning callback then a throwing callback. Select one to inspect its path.</p></div><div class="filters"><label for="policy-filter">Policy<select id="policy-filter"><option value="all">All policies</option><option value="deny">Deny</option><option value="allow">Allow</option><option value="requires_approval">Requires approval</option><option value="ambiguous">Ambiguous</option></select></label><label for="status-filter">Receipt<select id="status-filter"><option value="all">All outcomes</option><option value="blocked">Blocked</option><option value="dispatched">Dispatched</option><option value="unknown">Unknown</option></select></label><output id="filter-count" role="status" aria-live="polite">Loading vectors…</output></div><div class="board-key" aria-label="Outcome legend"><span class="key" data-status="dispatched"><i aria-hidden="true"></i>Dispatched</span><span class="key" data-status="unknown"><i aria-hidden="true"></i>Unknown</span><span class="key" data-status="blocked"><i aria-hidden="true"></i>Blocked</span><span>↗ callback returns · ! callback throws</span></div><div class="matrix-scroll" tabindex="0" role="region" aria-label="Scrollable vector matrix"><div id="matrix-grid" class="matrix-grid"></div></div><p class="board-foot">Colors are supported by text labels and each square has an accessible name. Horizontal scrolling reveals all four policies on narrow screens.</p></section>
-      <section class="case" id="case" aria-labelledby="case-title" hidden><div class="case-top"><div><div class="eyebrow" id="case-id"></div><h2 id="case-title"></h2><div class="reason" id="case-reason"></div></div><strong id="case-receipt" class="badge"></strong></div><p class="case-summary" id="case-summary"></p><ol class="path" id="case-path"></ol><div class="bindings"><div class="binding"><span>CALLER TARGET AFTER APPROVAL</span><strong id="case-caller"></strong></div><div class="binding"><span>FROZEN CALLBACK TARGET</span><strong id="case-target"></strong></div></div><p class="digest">Proposal SHA-256: <code id="case-digest"></code></p><div class="case-actions"><button type="button" class="copy" id="copy-link">Copy case link</button><a href="action-dispatch-matrix.json">Full JSON ↗</a><output id="copy-status" role="status" aria-live="polite"></output></div><details><summary>Inspect this raw vector</summary><pre id="case-json"></pre></details></section>
-      <section class="challenge" aria-labelledby="challenge-title"><div class="challenge-grid"><div><div class="eyebrow">SOURCE MUTATION CHALLENGE</div><h2 id="challenge-title">The case the matrix missed.</h2><p>We weakened seven guards in the actual reference source, one at a time. The 192-case matrix detected six. The seventh accepted a rule for the wrong resource, yet all 192 rows looked unchanged.</p><a href="action-dispatch-mutants.json">Inspect the source-bound results ↗</a></div><div class="challenge-signal"><div class="challenge-numbers"><div><strong>6</strong><span>CHANGES CAUGHT<br>BY THE MATRIX</span></div><div><strong>1</strong><span>GAP EXPOSED<br>BY A NEW PROBE</span></div></div><p>A proposal for <code>outside@example.test</code> meets a rule for <code>team@example.test</code>. The real boundary blocks before the host callback; the weakened version enters it once. The new probe keeps that distinction under test.</p></div></div></section>
-      <section class="method" aria-labelledby="method-title"><h2 id="method-title">What was actually checked?</h2><div><p>The Node runner calls the reference <code>dispatchAction</code> for all 192 local fixtures. A separate project-authored Python oracle checks each row, including receipt, digest, claim consumption, callback target, and marker write. CI rejects four deliberately falsified reports.</p><p>Reproduce with <code>node pilots/action-boundary/dispatch-matrix.mjs --check</code>, <code>python3 pilots/action-boundary/verify_dispatch_matrix.py docs/action-dispatch-matrix.json</code>, and <code>node pilots/action-boundary/dispatch-mutants.mjs --check</code>. <a href="https://github.com/aruintelligence/aml-core/blob/main/pilots/action-boundary/DISPATCH_MATRIX.md">Read the method and limits ↗</a></p><p><strong>Scope:</strong> Finite project-authored callbacks and selected mutations, no human approval, provider call, arbitrary interleavings, real delivery, outside witness, or formal proof of production safety. A browser view of the report does not independently verify its provenance. Never silently retry an unknown result.</p></div></section>
+      <section class="hero" aria-labelledby="title"><div><div class="eyebrow">ENGINEERING EVIDENCE / LOCAL DISPATCH</div><h1 id="title">The dispatch <span>proof atlas.</span></h1><p class="lead">One host boundary. Two resource scopes, four policy states, six approval behaviors, four claim behaviors, two callback outcomes. Explore every recorded combination, then inspect the receipt and the local effects that led to it.</p></div><aside class="hero-aside"><strong>One case is a snapshot.<br>384 cases reveal the edges.</strong><p id="source-state" role="status" aria-live="polite">Loading the checked-in matrix…</p><a href="action-dispatch-matrix.json">Download the full report ↗</a></aside></section>
+      <section class="totals" aria-label="Recorded local results"><div class="total"><span>CALLBACK RETURNED</span><strong id="count-dispatched">—</strong><p>Dispatched in a local fixture</p></div><div class="total"><span>CALLBACK THREW</span><strong id="count-unknown">—</strong><p>May follow a local write</p></div><div class="total"><span>STOPPED BEFORE CALLBACK</span><strong id="count-blocked">—</strong><p>Claim may still be consumed</p></div><div class="total"><span>FINITE COMBINATIONS</span><strong>384</strong><p>Exhaustive only over these axes</p></div></section>
+      <section aria-labelledby="lenses-title"><div class="section-heading"><div><div class="eyebrow">THREE IMPORTANT EDGES</div><h2 id="lenses-title">What a receipt hides.</h2></div><p>These counts describe the finite matrix, not a production rate. Each card opens one exact example below.</p></div><div class="lenses"><button type="button" class="lens" data-preset="100"><small id="insight-spent_and_blocked">LOADING / SPENT BEFORE DISPATCH</small><strong>Blocked, but the claim is gone.</strong><span>The claim hook consumes a one-use grant, then throws. The callback stays untouched; the grant is still spent. ↗</span></button><button type="button" class="lens" data-preset="49"><small id="insight-unknown_after_write">LOADING / UNCERTAIN OUTCOME</small><strong>Unknown after a local write.</strong><span>A callback writes a marker, then throws. The receipt cannot turn that into proof of no effect. ↗</span></button><button type="button" class="lens" data-preset="136"><small id="insight-frozen_after_mutation">LOADING / FROZEN DESTINATION</small><strong>The caller changes; the target does not.</strong><span>During approval the caller mutates its object. The callback still receives the original canonical destination. ↗</span></button><button type="button" class="lens" data-preset="240"><small id="insight-other_rule_blocked">LOADING / RESOURCE MISMATCH</small><strong>A rule for somewhere else.</strong><span>The proposal keeps its declared resource, but the host policy rule names another. Every such case stops before the callback. ↗</span></button></div></section>
+      <section class="board" aria-labelledby="board-title"><div class="board-head"><div><div class="eyebrow">THE COMPLETE CROSS-PRODUCT</div><h2 id="board-title">Every local path.</h2></div><p>Each square is one vector. Columns are policy states; rows are approval-hook behaviors. Each row has an exact-rule lane and an other-resource-rule lane. Squares follow the four claim behaviors, with a returning callback then a throwing callback. Select one to inspect its path.</p></div><div class="filters"><label for="resource-filter">Policy rule resource<select id="resource-filter"><option value="all">Both scopes</option><option value="exact">Original scope</option><option value="other">Other resource</option></select></label><label for="policy-filter">Policy<select id="policy-filter"><option value="all">All policies</option><option value="deny">Deny</option><option value="allow">Allow</option><option value="requires_approval">Requires approval</option><option value="ambiguous">Ambiguous</option></select></label><label for="status-filter">Receipt<select id="status-filter"><option value="all">All outcomes</option><option value="blocked">Blocked</option><option value="dispatched">Dispatched</option><option value="unknown">Unknown</option></select></label><output id="filter-count" role="status" aria-live="polite">Loading vectors…</output></div><div class="board-key" aria-label="Outcome legend"><span class="key" data-status="dispatched"><i aria-hidden="true"></i>Dispatched</span><span class="key" data-status="unknown"><i aria-hidden="true"></i>Unknown</span><span class="key" data-status="blocked"><i aria-hidden="true"></i>Blocked</span><span>↗ callback returns · ! callback throws</span></div><div class="matrix-scroll" tabindex="0" role="region" aria-label="Scrollable vector matrix"><div id="matrix-grid" class="matrix-grid"></div></div><p class="board-foot">Colors are supported by text labels and each square has an accessible name. Horizontal scrolling reveals all four policies on narrow screens.</p></section>
+      <section class="case" id="case" aria-labelledby="case-title" hidden><div class="case-top"><div><div class="eyebrow" id="case-id"></div><h2 id="case-title"></h2><div class="reason" id="case-reason"></div></div><strong id="case-receipt" class="badge"></strong></div><p class="case-summary" id="case-summary"></p><ol class="path" id="case-path"></ol><div class="bindings"><div class="binding"><span>PROPOSAL RESOURCE</span><strong id="case-resource"></strong></div><div class="binding"><span>POLICY RULE RESOURCE</span><strong id="case-rule"></strong></div><div class="binding"><span>CALLER TARGET AFTER APPROVAL</span><strong id="case-caller"></strong></div><div class="binding"><span>FROZEN CALLBACK TARGET</span><strong id="case-target"></strong></div></div><p class="digest">Proposal SHA-256: <code id="case-digest"></code></p><div class="case-actions"><button type="button" class="copy" id="copy-link">Copy case link</button><a href="action-dispatch-matrix.json">Full JSON ↗</a><output id="copy-status" role="status" aria-live="polite"></output></div><details><summary>Inspect this raw vector</summary><pre id="case-json"></pre></details></section>
+      <section class="challenge" aria-labelledby="challenge-title"><div class="challenge-grid"><div><div class="eyebrow">SOURCE MUTATION CHALLENGE</div><h2 id="challenge-title">A gap found. Then closed.</h2><p>A seven-guard source challenge found a blind spot: the earlier 192-case matrix missed a weakened resource check. Adding a second resource scope doubles the local cross-product. The 384-case matrix detects all seven selected changes.</p><a href="action-dispatch-mutants.json">Inspect the source-bound results ↗</a></div><div class="challenge-signal"><div class="challenge-numbers"><div><strong>7/7</strong><span>SELECTED GUARD CHANGES<br>DETECTED BY THE MATRIX</span></div><div><strong>192</strong><span>OTHER-RESOURCE CASES<br>BLOCKED BEFORE CALLBACK</span></div></div><p>The proposal names <code>team@example.test</code>; its policy rule names <code>outside@example.test</code>. Every mismatched-rule fixture blocks with no callback. A version with resource matching deliberately weakened changes all 192 new rows. The original focused probe remains a separate regression check.</p></div></div></section>
+      <section class="method" aria-labelledby="method-title"><h2 id="method-title">What was actually checked?</h2><div><p>The Node runner calls the reference <code>dispatchAction</code> for all 384 local fixtures. A separate project-authored Python oracle checks each row, including receipt, digest, claim consumption, callback target, and marker write. CI rejects four deliberately falsified reports.</p><p>Reproduce with <code>node pilots/action-boundary/dispatch-matrix.mjs --check</code>, <code>python3 pilots/action-boundary/verify_dispatch_matrix.py docs/action-dispatch-matrix.json</code>, and <code>node pilots/action-boundary/dispatch-mutants.mjs --check</code>. <a href="https://github.com/aruintelligence/aml-core/blob/main/pilots/action-boundary/DISPATCH_MATRIX.md">Read the method and limits ↗</a></p><p><strong>Scope:</strong> Finite project-authored callbacks and selected mutations, no human approval, provider call, arbitrary interleavings, real delivery, outside witness, or formal proof of production safety. A browser view of the report does not independently verify its provenance. Never silently retry an unknown result.</p></div></section>
     </main><footer class="foot">ĀML™ / ĀRU Intelligence Inc. · Local evidence, inspectable limits. <a href="https://github.com/aruintelligence/aml-core/blob/main/CLAIMS.md">Claims and evidence ↗</a></footer>
   </div>
-  <script type="module" src="dispatch-matrix.js?v=fb499a0e3d36"></script>
+  <script type="module" src="dispatch-matrix.js?v=d951f9f7b943"></script>
 </body>
 </html>
diff --git a/docs/dispatch-matrix.js b/docs/dispatch-matrix.js
index 8f950242..99288b77 100644
--- a/docs/dispatch-matrix.js
+++ b/docs/dispatch-matrix.js
@@ -1,5 +1,6 @@
 // A viewer for a checked-in project report, not a verifier or live dispatch.
 export const MATRIX_AXES = Object.freeze({
+  resource_scope: ["exact", "other"],
   policy: ["deny", "allow", "requires_approval", "ambiguous"],
   approval: ["match", "decline", "mismatch", "throw", "revoke", "mutate_caller"],
   claim: ["accept", "refuse", "throw_after_consume", "revoke_after_consume"],
@@ -7,24 +8,29 @@ export const MATRIX_AXES = Object.freeze({
 });
 
 const statuses = ["blocked", "dispatched", "unknown"];
-export const matrixIndex = (policy, approval, claim, callback) =>
+export const matrixIndex = (policy, approval, claim, callback, resourceScope = "exact") =>
+  MATRIX_AXES.resource_scope.indexOf(resourceScope) * 192 +
   (((MATRIX_AXES.policy.indexOf(policy) * 6 + MATRIX_AXES.approval.indexOf(approval)) * 4 +
     MATRIX_AXES.claim.indexOf(claim)) * 2 + MATRIX_AXES.callback.indexOf(callback));
 
 export function inspectMatrix(report) {
   if (!report || report.protocol !== "aml-action-dispatch-matrix/1" ||
       report.provenance !== "project-authored bounded cross-product of local callbacks" ||
-      !Array.isArray(report.rows) || report.rows.length !== 192 ||
+      !Array.isArray(report.rows) || report.rows.length !== 384 ||
       Object.keys(MATRIX_AXES).some(key => JSON.stringify(report.axes?.[key]) !== JSON.stringify(MATRIX_AXES[key]))) {
     throw new TypeError("Unexpected matrix format");
   }
   const counts = { blocked: 0, dispatched: 0, unknown: 0 };
   report.rows.forEach((row, index) => {
-    const p = Math.floor(index / 48);
+    const s = Math.floor(index / 192);
+    const p = Math.floor(index / 48) % 4;
     const a = Math.floor(index / 8) % 6;
     const c = Math.floor(index / 2) % 4;
     const b = index % 2;
-    if (!row || row.policy !== MATRIX_AXES.policy[p] || row.approval !== MATRIX_AXES.approval[a] ||
+    if (!row || row.resource_scope !== MATRIX_AXES.resource_scope[s] ||
+        row.proposal_resource !== "team@example.test" ||
+        row.policy_rule_resource !== (row.policy === "deny" && s === 0 ? null : s === 0 ? "team@example.test" : "outside@example.test") ||
+        row.policy !== MATRIX_AXES.policy[p] || row.approval !== MATRIX_AXES.approval[a] ||
         row.claim !== MATRIX_AXES.claim[c] || row.callback !== MATRIX_AXES.callback[b] ||
         row.receipt?.protocol !== "aml-action-dispatch/1" ||
         !statuses.includes(row.receipt.execution_status) ||
@@ -35,25 +41,27 @@ export function inspectMatrix(report) {
   });
   // Detect a stale or partial report. The independent Python oracle is the real
   // row-by-row check in CI; these browser checks only guard this presentation.
-  if (counts.blocked !== 140 || counts.dispatched !== 26 || counts.unknown !== 26) {
+  if (counts.blocked !== 332 || counts.dispatched !== 26 || counts.unknown !== 26) {
     throw new TypeError("Unexpected matrix totals");
   }
   return counts;
 }
 
-export function visibleMatrixIndices(report, policy = "all", status = "all") {
-  if (!["all", ...MATRIX_AXES.policy].includes(policy) || !["all", ...statuses].includes(status)) {
+export function visibleMatrixIndices(report, policy = "all", status = "all", resourceScope = "all") {
+  if (!["all", ...MATRIX_AXES.policy].includes(policy) || !["all", ...statuses].includes(status) ||
+      !["all", ...MATRIX_AXES.resource_scope].includes(resourceScope)) {
     throw new RangeError("Unknown matrix filter");
   }
   return report.rows.flatMap((row, index) =>
     (policy === "all" || row.policy === policy) &&
+    (resourceScope === "all" || row.resource_scope === resourceScope) &&
     (status === "all" || row.receipt.execution_status === status) ? [index] : []);
 }
 
-export function matrixGroupSlots(policy, approval, visibleIndices) {
+export function matrixGroupSlots(policy, approval, visibleIndices, resourceScope = "exact") {
   const visible = new Set(visibleIndices);
   return MATRIX_AXES.claim.flatMap(claim => MATRIX_AXES.callback.map(callback => {
-    const index = matrixIndex(policy, approval, claim, callback);
+    const index = matrixIndex(policy, approval, claim, callback, resourceScope);
     return visible.has(index) ? index : null;
   }));
 }
@@ -65,7 +73,9 @@ export function matrixInsights(report) {
     unknown_after_write: report.rows.filter(row => row.receipt.execution_status === "unknown" &&
       row.callback_count === 1 && row.fixture_writes === 1).length,
     frozen_after_mutation: report.rows.filter(row => row.approval === "mutate_caller" &&
-      row.callback_count === 1 && row.caller_target_after !== row.callback_target).length
+      row.callback_count === 1 && row.caller_target_after !== row.callback_target).length,
+    other_rule_blocked: report.rows.filter(row => row.resource_scope === "other" &&
+      row.receipt.execution_status === "blocked" && row.callback_count === 0).length
   };
 }
 
@@ -97,8 +107,10 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
   const params = new URLSearchParams(location.search);
   const startingPolicy = params.get("policy");
   const startingStatus = params.get("status");
+  const startingResource = params.get("resource");
   if (["all", ...MATRIX_AXES.policy].includes(startingPolicy)) $("policy-filter").value = startingPolicy;
   if (["all", ...statuses].includes(startingStatus)) $("status-filter").value = startingStatus;
+  if (["all", ...MATRIX_AXES.resource_scope].includes(startingResource)) $("resource-filter").value = startingResource;
   let report;
   let selected = params.has("vector") ? null : 49;
   let visible = [];
@@ -109,8 +121,8 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
       button.setAttribute("aria-pressed", String(Number(button.dataset.index) === index)));
     const row = report.rows[index];
     const receipt = row.receipt;
-    $("case-id").textContent = `VECTOR ${String(index + 1).padStart(3, "0")} / 192`;
-    $("case-title").textContent = `${label(row.policy)} · ${label(row.approval)} · ${label(row.claim)} · ${label(row.callback)}`;
+    $("case-id").textContent = `VECTOR ${String(index + 1).padStart(3, "0")} / 384`;
+    $("case-title").textContent = `${row.resource_scope === "exact" ? "Original resource scope" : "Other resource rule"} · ${label(row.policy)} · ${label(row.approval)} · ${label(row.claim)} · ${label(row.callback)}`;
     $("case-receipt").textContent = receipt.execution_status.toUpperCase();
     $("case-receipt").dataset.status = receipt.execution_status;
     $("case-reason").textContent = `receipt.reason = ${receipt.reason}`;
@@ -120,9 +132,11 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
         "The project fixture callback returned. This does not show external delivery." :
         row.claims_consumed ?
           "The local approval claim was consumed even though the tool callback was blocked. A blocked receipt does not mean the claim is reusable." :
-          "The tool callback was not entered in this local vector.";
+          row.resource_scope === "other" ?
+            "The policy rule names a different resource. This local path denies before approval or the callback." :
+            "The tool callback was not entered in this local vector.";
     const values = [
-      ["01 / HOST POLICY", `${label(receipt.policy_decision)} · exact-match decision`],
+      ["01 / HOST POLICY", `${label(receipt.policy_decision)} · ${label(receipt.reason)}`],
       ["02 / APPROVAL HOOK", row.approval_requests ?
         `${row.approval_requests} request · ${label(row.approval)} fixture` :
         `0 requests · configured ${label(row.approval)} hook not called`],
@@ -136,6 +150,8 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
     }));
     $("case-caller").textContent = row.caller_target_after;
     $("case-target").textContent = row.callback_target ?? "No callback entry";
+    $("case-resource").textContent = row.proposal_resource;
+    $("case-rule").textContent = row.policy_rule_resource ?? "No rule";
     $("case-digest").textContent = receipt.proposal_sha256 ?? "No digest (invalid or ambiguous policy)";
     $("case-json").textContent = JSON.stringify(row, null, 2);
     if (changeUrl) history.replaceState(null, "", matrixUrl(location.href, index, report));
@@ -144,38 +160,45 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
   function render() {
     const policy = $("policy-filter").value;
     const status = $("status-filter").value;
-    visible = visibleMatrixIndices(report, policy, status);
+    const resource = $("resource-filter").value;
+    visible = visibleMatrixIndices(report, policy, status, resource);
     const visibleSet = new Set(visible);
-    $("filter-count").textContent = `${visible.length} of 192 vectors shown`;
+    $("filter-count").textContent = `${visible.length} of 384 vectors shown`;
     const columns = MATRIX_AXES.policy.map(policyName => {
       const col = element("section", "policy-column", "");
       col.append(element("h3", "", label(policyName)));
       for (const approvalName of MATRIX_AXES.approval) {
         const group = element("div", "approval-group", "");
         group.append(element("h4", "", label(approvalName)));
-        const cells = element("div", "cells", "");
-        let matches = 0;
-        for (const index of matrixGroupSlots(policyName, approvalName, visible)) {
-          if (index === null) {
-            const placeholder = element("span", "cell-placeholder", "");
-            placeholder.setAttribute("aria-hidden", "true");
-            cells.append(placeholder);
-            continue;
+        for (const scope of resource === "all" ? MATRIX_AXES.resource_scope : [resource]) {
+          const lane = element("div", "scope-lane", "");
+          lane.dataset.scope = scope;
+          lane.append(element("span", "scope-label", scope === "exact" ? "Original scope" : "Other resource rule"));
+          const cells = element("div", "cells", "");
+          let matches = 0;
+          for (const index of matrixGroupSlots(policyName, approvalName, visible, scope)) {
+            if (index === null) {
+              const placeholder = element("span", "cell-placeholder", "");
+              placeholder.setAttribute("aria-hidden", "true");
+              cells.append(placeholder);
+              continue;
+            }
+            matches++;
+            const row = report.rows[index];
+            const button = element("button", "vector", row.callback === "return" ? "↗" : "!");
+            button.type = "button";
+            button.dataset.index = String(index);
+            button.dataset.status = row.receipt.execution_status;
+            button.setAttribute("aria-label", `Vector ${index + 1}: ${[scope, policyName, approvalName, row.claim, row.callback].map(label).join(", ")}; ${row.receipt.execution_status}`);
+            button.setAttribute("aria-pressed", "false");
+            button.title = `${label(scope)} / ${label(row.claim)} / ${label(row.callback)} → ${row.receipt.execution_status}`;
+            button.addEventListener("click", () => showCase(index));
+            cells.append(button);
           }
-          matches++;
-          const row = report.rows[index];
-          const button = element("button", "vector", row.callback === "return" ? "↗" : "!");
-          button.type = "button";
-          button.dataset.index = String(index);
-          button.dataset.status = row.receipt.execution_status;
-          button.setAttribute("aria-label", `Vector ${index + 1}: ${[policyName, approvalName, row.claim, row.callback].map(label).join(", ")}; ${row.receipt.execution_status}`);
-          button.setAttribute("aria-pressed", "false");
-          button.title = `${label(row.claim)} / ${label(row.callback)} → ${row.receipt.execution_status}`;
-          button.addEventListener("click", () => showCase(index));
-          cells.append(button);
+          if (!matches) cells.replaceChildren(element("span", "empty", "No matches"));
+          lane.append(cells);
+          group.append(lane);
         }
-        if (!matches) cells.replaceChildren(element("span", "empty", "No matches"));
-        group.append(cells);
         col.append(group);
       }
       return col;
@@ -190,7 +213,7 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
       $("case").hidden = true;
     }
     const url = new URL(location.href);
-    for (const [key, value] of [["policy", policy], ["status", status]]) {
+    for (const [key, value] of [["policy", policy], ["status", status], ["resource", resource]]) {
       if (value === "all") url.searchParams.delete(key);
       else url.searchParams.set(key, value);
     }
@@ -207,13 +230,15 @@ if (typeof document !== "undefined" && document.getElementById("matrix-grid")) {
     for (const status of statuses) $(`count-${status}`).textContent = String(counts[status]);
     const insights = matrixInsights(report);
     for (const [name, count] of Object.entries(insights)) $(`insight-${name}`).textContent = `${count} vectors`;
-    $("source-state").textContent = "Checked-in matrix loaded · 192 finite local vectors";
+    $("source-state").textContent = "Checked-in matrix loaded · 384 finite local vectors";
     $("policy-filter").addEventListener("change", render);
     $("status-filter").addEventListener("change", render);
+    $("resource-filter").addEventListener("change", render);
     for (const button of document.querySelectorAll("[data-preset]")) {
       button.addEventListener("click", () => {
         $("policy-filter").value = "all";
         $("status-filter").value = "all";
+        $("resource-filter").value = "all";
         render();
         showCase(Number(button.dataset.preset));
         $("case").scrollIntoView({ behavior: matchMedia("(prefers-reduced-motion: reduce)").matches ? "auto" : "smooth" });
diff --git a/docs/index.html b/docs/index.html
index ba913b8e..e8819fdb 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -55,7 +55,7 @@
         <div class="eyebrow">ĀRU MEANING LANGUAGE™ · RESEARCH PROTOTYPE</div>
         <h1>AI proposes.<br><span class="gradient">The host decides.</span></h1>
         <p class="lede">An agent asks to use a tool. An app asks to show an interface. ĀML makes the host's policy decision and its evidence inspectable at both boundaries. Change one input below and follow the exact path.</p>
-        <div class="hero-actions"><a class="button" href="first-run.html">Begin the first decision ↗</a><a class="ghost" href="dispatch-matrix.html">Explore 192 dispatch paths ↗</a><a class="ghost" href="playground.html?example=compare#live-stage">Watch two live gates ↗</a><a class="ghost" href="check-run.html?example=challenge">Break a saved run ↗</a></div>
+        <div class="hero-actions"><a class="button" href="first-run.html">Begin the first decision ↗</a><a class="ghost" href="dispatch-matrix.html">Explore 384 dispatch paths ↗</a><a class="ghost" href="playground.html?example=compare#live-stage">Watch two live gates ↗</a><a class="ghost" href="check-run.html?example=challenge">Break a saved run ↗</a></div>
         <div class="equation" id="hero-equation">proposal → exact rule → host decision → receipt</div>
         <p class="hero-note" id="hero-note">Connecting to the project preview. No tool runs, no message is sent, and no person is asked to approve.</p>
       </div>
diff --git a/pilots/action-boundary/DISPATCH_MATRIX.md b/pilots/action-boundary/DISPATCH_MATRIX.md
index 495a72b5..3cc99d10 100644
--- a/pilots/action-boundary/DISPATCH_MATRIX.md
+++ b/pilots/action-boundary/DISPATCH_MATRIX.md
@@ -1,6 +1,6 @@
 # Bounded dispatch cross-product
 
-This project-authored check enumerates **192 combinations** of four host policy states, six approval-hook behaviors, four claim-hook behaviors, and two callback outcomes. The Node runner calls the actual `dispatchAction` reference implementation for each vector. A separate Python state oracle checks every receipt, proposal digest, callback count and target, claim count, and in-memory fixture write without importing the JavaScript implementation.
+This project-authored check enumerates **384 combinations** of two resource-rule scopes, four host policy states, six approval-hook behaviors, four claim-hook behaviors, and two callback outcomes. The Node runner calls the actual `dispatchAction` reference implementation for each vector. A separate Python state oracle checks every receipt, proposal digest, declared and rule resource, callback count and target, claim count, and in-memory fixture write without importing the JavaScript implementation.
 
 ```bash
 node pilots/action-boundary/dispatch-matrix.mjs --check
@@ -12,18 +12,18 @@ node --test test/action-boundary-mutation-proof.test.js
 
 The [complete checked-in matrix](../../docs/action-dispatch-matrix.json) is deterministic. To regenerate it after an intentional behavior change, run `node pilots/action-boundary/dispatch-matrix.mjs --write`, review the changed rows, and run the Python oracle. The test deliberately changes a blocked status, callback count, digest, and scope claim in separate copies; all four must fail verification. CI runs both languages.
 
-The finite axes include an exact allow, an exact approval-required rule, no matching rule, and ambiguous duplicate rules; matched, declined, mismatched, thrown, revoked, and caller-mutating approval hooks; accepted, refused, thrown-after-consumption, and revoked-after-consumption claim hooks; and returning versus throwing-after-a-local-write callbacks.
+The finite axes include a policy rule for the proposal's resource or a rule for another resource; an allow rule, an approval-required rule, no matching rule, and ambiguous duplicate rules; matched, declined, mismatched, thrown, revoked, and caller-mutating approval hooks; accepted, refused, thrown-after-consumption, and revoked-after-consumption claim hooks; and returning versus throwing-after-a-local-write callbacks. The first 192 row indices preserve the earlier exact-resource matrix and its deep links; the second 192 use rules for another resource. The exact-scope no-rule policy remains empty, while the other-scope no-match policy has a different-resource rule. Duplicate rules for another resource do not match the proposal.
 
-The checked matrix has 26 `dispatched`, 26 `unknown`, and 140 `blocked` receipts. For these vectors, every callback is reached only through an exact allow rule or a matched approval plus an accepted claim under unchanged policy. An `unknown` receipt follows one callback entry and one local marker write. A claim can remain consumed even when dispatch blocks after a claim error or revocation. The callback sees the original canonical destination when the caller changes its object during approval.
+The checked matrix has 26 `dispatched`, 26 `unknown`, and 332 `blocked` receipts. All 192 other-resource cases block before approval or the tool callback. For the exact-resource vectors, every callback is reached only through an exact allow rule or a matched approval plus an accepted claim under unchanged policy. An `unknown` receipt follows one callback entry and one local marker write. A claim can remain consumed even when dispatch blocks after a claim error or revocation. The callback sees the original canonical destination when the caller changes its object during approval.
 
-The [interactive atlas](../../docs/dispatch-matrix.html) derives three additional counts from these rows: **8 blocked vectors with consumed claims**, **26 unknown vectors after a local marker write**, and **2 callback vectors with a changed caller object but the original frozen target**. Filters and deep links reveal each exact receipt and counters. These are proportions of a deliberately selected finite cross-product, not estimates of real-world frequency.
+The [interactive atlas](../../docs/dispatch-matrix.html) derives four additional counts from these rows: **8 blocked vectors with consumed claims**, **26 unknown vectors after a local marker write**, **2 callback vectors with a changed caller object but the original frozen target**, and **192 other-resource vectors blocked before the callback**. Resource, policy, and receipt filters reveal each exact outcome and its declared versus policy resource. These are counts in a deliberately selected finite cross-product, not estimates of real-world frequency.
 
 ## Source mutation challenge
 
 The [checked-in mutation report](../../docs/action-dispatch-mutants.json) loads seven exact, one-at-a-time substitutions of `boundary.mjs` and reruns the actual dispatch matrix against each changed module. A replacement must match exactly once, so a changed source guard makes the check fail until the substitutions are reviewed. The report records the source and matrix SHA-256 digests, changed-row counts, and the first differing vector with both outcomes. The independent Python oracle checks the unchanged matrix; the mutation comparisons use the checked-in baseline verified by that oracle.
 
-Six substitutions change matrix rows: bypassing the approval digest check (8 rows), skipping the one-use claim (16), skipping the policy recheck after approval (8), skipping the recheck after claim (4), passing the caller's mutable object to the callback (2), and calling an uncertain callback failure blocked (26). These counts are differences from the baseline, not real-world rates or independent defect counts.
+All seven selected substitutions now change matrix rows: bypassing the approval digest check (8 rows), skipping the one-use claim (16), skipping the policy recheck after approval (8), skipping the recheck after claim (4), passing the caller's mutable object to the callback (2), calling an uncertain callback failure blocked (26), and accepting another resource's rule (192). These counts are differences from the baseline, not real-world rates or independent defect counts.
 
-The seventh substitution changes resource matching to accept a rule for any resource. It changes **zero** of the 192 matrix rows because the matrix has no mismatched-resource fixture. The added local resource-substitution probe presents a proposal for `outside@example.test` with a rule only for `team@example.test`: the reference boundary blocks with `no_exact_rule` and zero callback entries, while the mutant dispatches once. CI runs the probe against the unchanged boundary as a direct regression test and regenerates the mutation report. Reproduce the report with `node pilots/action-boundary/dispatch-mutants.mjs --check`; after an intentional source or fixture change, review `--write` output and rerun both checks.
+The seventh substitution exposed a gap in the earlier 192-case matrix: it changed zero rows because every policy rule used the proposal's resource or was absent. The new resource axis closes that specific gap. Under the changed source, all 192 new rows differ in plan or receipt; in the reference implementation, all 192 other-resource rows block with `no_exact_rule` and no callback. The separate local resource-substitution probe remains a direct regression check: a proposal for `outside@example.test` with a rule only for `team@example.test` blocks in the real boundary, while the mutant dispatches once. CI reruns both checks. Reproduce the mutation report with `node pilots/action-boundary/dispatch-mutants.mjs --check`; after an intentional source or fixture change, review `--write` output and rerun both checks.
 
 **Limits:** This is exhaustive only over the declared finite axes and one local callback attempt per vector. The mutation challenge samples seven chosen guard changes, not arbitrary bugs or equivalent mutants. It does not explore arbitrary interleavings, crashes, malicious host hooks, providers, network effects, human authorization, or delivery. The Python oracle is independently coded but project-authored; it is not an outside witness or formal proof of production safety. Real hosts must own policy, authentication, one-use claims, operation idempotency, and reconciliation. Never silently retry an unknown result.
diff --git a/pilots/action-boundary/README.md b/pilots/action-boundary/README.md
index 84c5ae2d..23d8ead3 100644
--- a/pilots/action-boundary/README.md
+++ b/pilots/action-boundary/README.md
@@ -12,11 +12,11 @@ Agents can propose a tool call; the host must decide whether to dispatch it. Thi
 
 [**Rehearse seventeen host paths**](https://aruintelligence.github.io/aml-core/agent-start.html?case=unknown_then_replay#rehearsal) with `node pilots/action-boundary/guarded-tool-rehearsal.mjs --list`, `--case <id>`, and `--check`. The project-authored fixture callbacks do not authenticate anyone or contact a provider. After editing fixtures, run `node pilots/action-boundary/guarded-tool-rehearsal.mjs --write` and `node scripts/refresh-agent-start-assets.mjs --write`; its `--check` mode verifies the static page's content-based asset URLs. An `unknown` receipt can follow a local state change and must not trigger a silent retry.
 
-[**Check the 192-vector dispatch matrix**](DISPATCH_MATRIX.md) across policy, approval, claim, and callback behaviors. Node records the reference boundary's local results, and a separate project-authored Python oracle checks every row and rejects four deliberate alterations, including an inflated scope claim. It is a bounded executable check, not an independent audit or proof of real delivery.
+[**Check the 384-vector dispatch matrix**](DISPATCH_MATRIX.md) across rule resource, policy, approval, claim, and callback behaviors. Node records the reference boundary's local results, and a separate project-authored Python oracle checks every row and rejects deliberate alterations, including an inflated scope claim. It is a bounded executable check, not an independent audit or proof of real delivery.
 
-[**Explore the proof atlas**](../../docs/dispatch-matrix.html) to filter all 192 results, inspect the local effects behind one receipt, and share an exact vector. The page presents the checked-in report; it does not itself provide an outside verification.
+[**Explore the proof atlas**](../../docs/dispatch-matrix.html) to filter all 384 results, compare exact and other-resource policy rules, inspect the local effects behind one receipt, and share an exact vector. The page presents the checked-in report; it does not itself provide an outside verification.
 
-[**Challenge seven source guards**](DISPATCH_MATRIX.md#source-mutation-challenge) by applying exact one-at-a-time substitutions to the reference boundary. Six changes alter matrix rows; weakening exact resource matching leaves all 192 rows unchanged. A new local substitution probe exposes that gap and keeps it under a direct regression check. The [mutation report](../../docs/action-dispatch-mutants.json) records source digests and first differing outcomes; it does not measure general defect coverage.
+[**Challenge seven source guards**](DISPATCH_MATRIX.md#source-mutation-challenge) by applying exact one-at-a-time substitutions to the reference boundary. The earlier 192-case matrix missed weakened resource matching; the new second resource scope makes all seven selected changes observable in matrix rows. A separate local substitution probe still checks that particular rule mismatch directly. The [mutation report](../../docs/action-dispatch-mutants.json) records source digests and first differing outcomes; it does not measure general defect coverage.
 
 [**Bind all recipients in a mail function tool**](MAIL_GUARDED_TOOL.md) with `createMailGuardedToolExecute` when the host callback accepts To, CC, or BCC. The [seven-case visual comparison](https://aruintelligence.github.io/aml-core/mail-tool-integration.html?case=added_bcc#cases) executes both adapters with in-memory callbacks. It is a narrow host-side integration example, not a live provider or authenticated approval.
 
diff --git a/pilots/action-boundary/dispatch-matrix.mjs b/pilots/action-boundary/dispatch-matrix.mjs
index ba8d544f..4aa9278d 100644
--- a/pilots/action-boundary/dispatch-matrix.mjs
+++ b/pilots/action-boundary/dispatch-matrix.mjs
@@ -9,20 +9,23 @@ import { dispatchAction } from "./boundary.mjs";
 
 const reportUrl = new URL("../../docs/action-dispatch-matrix.json", import.meta.url);
 export const axes = Object.freeze({
+  resource_scope: ["exact", "other"],
   policy: ["deny", "allow", "requires_approval", "ambiguous"],
   approval: ["match", "decline", "mismatch", "throw", "revoke", "mutate_caller"],
   claim: ["accept", "refuse", "throw_after_consume", "revoke_after_consume"],
   callback: ["return", "throw_after_write"]
 });
 
-async function runVector(dispatch, policyMode, approvalMode, claimMode, callbackMode) {
+async function runVector(dispatch, resourceScope, policyMode, approvalMode, claimMode, callbackMode) {
   const proposal = { protocol: "aml-proposed-action/1", tool: "send_message", effect: "send",
     resource: "team@example.test", purpose: "Matrix local callback",
     arguments: { to: "team@example.test", body: "Build passed." } };
-  const rule = { tool: proposal.tool, effect: proposal.effect, resource: proposal.resource,
+  const rule = { tool: proposal.tool, effect: proposal.effect,
+    resource: resourceScope === "exact" ? proposal.resource : "outside@example.test",
     requires_approval: policyMode === "requires_approval" };
   const policy = { protocol: "aml-action-policy/1",
-    rules: policyMode === "deny" ? [] : policyMode === "ambiguous" ? [rule, { ...rule }] : [rule] };
+    rules: policyMode === "deny" && resourceScope === "exact" ? [] :
+      policyMode === "ambiguous" ? [rule, { ...rule }] : [rule] };
   let approvalRequests = 0;
   let claimAttempts = 0;
   let claimsConsumed = 0;
@@ -60,7 +63,10 @@ async function runVector(dispatch, policyMode, approvalMode, claimMode, callback
       return { would_send_to: frozen.arguments.to };
     }
   });
-  return { policy: policyMode, approval: approvalMode, claim: claimMode, callback: callbackMode,
+  return { resource_scope: resourceScope, proposal_resource: proposal.resource,
+    policy_rule_resource: policyMode === "deny" && resourceScope === "exact" ? null : rule.resource,
+    policy: policyMode, approval: approvalMode,
+    claim: claimMode, callback: callbackMode,
     receipt: outcome.receipt, approval_requests: approvalRequests, claim_attempts: claimAttempts,
     claims_consumed: claimsConsumed, callback_count: callbackCount, fixture_writes: fixtureWrites,
     callback_target: callbackTarget, caller_target_after: proposal.arguments.to,
@@ -69,12 +75,12 @@ async function runVector(dispatch, policyMode, approvalMode, claimMode, callback
 
 export async function buildDispatchMatrix(dispatch = dispatchAction) {
   const rows = [];
-  for (const policy of axes.policy) for (const approval of axes.approval)
+  for (const resourceScope of axes.resource_scope) for (const policy of axes.policy) for (const approval of axes.approval)
     for (const claim of axes.claim) for (const callback of axes.callback)
-      rows.push(await runVector(dispatch, policy, approval, claim, callback));
+      rows.push(await runVector(dispatch, resourceScope, policy, approval, claim, callback));
   return { protocol: "aml-action-dispatch-matrix/1",
     provenance: "project-authored bounded cross-product of local callbacks",
-    limits: "192 finite combinations. No human approval, provider call, delivery, arbitrary interleaving, or production safety proof.",
+    limits: "384 finite combinations. No human approval, provider call, delivery, arbitrary interleaving, or production safety proof.",
     axes, rows };
 }
 
diff --git a/pilots/action-boundary/dispatch-mutants.mjs b/pilots/action-boundary/dispatch-mutants.mjs
index c7ed4a86..9e33984f 100644
--- a/pilots/action-boundary/dispatch-mutants.mjs
+++ b/pilots/action-boundary/dispatch-mutants.mjs
@@ -76,6 +76,7 @@ async function loadMutant(source, mutation) {
 
 function outcome(row) {
   return {
+    proposal_resource: row.proposal_resource, policy_rule_resource: row.policy_rule_resource,
     receipt: row.receipt, approval_requests: row.approval_requests,
     claim_attempts: row.claim_attempts, claims_consumed: row.claims_consumed,
     callback_count: row.callback_count, fixture_writes: row.fixture_writes,
@@ -122,7 +123,7 @@ export async function buildDispatchMutants() {
       matrix_changed_rows: differences.length,
       first_changed_vector: first === undefined ? null : {
         index: first, axes: Object.fromEntries(
-          ["policy", "approval", "claim", "callback"].map(axis => [axis, rows[first][axis]])),
+          ["resource_scope", "policy", "approval", "claim", "callback"].map(axis => [axis, rows[first][axis]])),
         reference: outcome(reference.rows[first]), mutant: outcome(rows[first])
       },
       resource_probe_changed: JSON.stringify(probe) !== JSON.stringify(baselineProbe),
diff --git a/pilots/action-boundary/verify_dispatch_matrix.py b/pilots/action-boundary/verify_dispatch_matrix.py
index 6fd8b8a4..1c617556 100644
--- a/pilots/action-boundary/verify_dispatch_matrix.py
+++ b/pilots/action-boundary/verify_dispatch_matrix.py
@@ -7,6 +7,7 @@
 import sys
 
 AXES = {
+    "resource_scope": ["exact", "other"],
     "policy": ["deny", "allow", "requires_approval", "ambiguous"],
     "approval": ["match", "decline", "mismatch", "throw", "revoke", "mutate_caller"],
     "claim": ["accept", "refuse", "throw_after_consume", "revoke_after_consume"],
@@ -21,15 +22,15 @@
                                    ensure_ascii=False).encode("utf-8")).hexdigest()
 
 
-def expected(policy, approval, claim, callback):
+def expected(resource_scope, policy, approval, claim, callback):
     requests = attempts = consumed = callbacks = writes = 0
     target = result = None
     caller = "team@example.test"
-    decision = "deny" if policy in ("deny", "ambiguous") else (
+    decision = "deny" if resource_scope == "other" or policy in ("deny", "ambiguous") else (
         "allow" if policy == "allow" else "requires_approval")
-    digest = None if policy == "ambiguous" else DIGEST
+    digest = None if resource_scope == "exact" and policy == "ambiguous" else DIGEST
 
-    if policy == "deny":
+    if resource_scope == "other" or policy == "deny":
         status, reason = "blocked", "no_exact_rule"
     elif policy == "ambiguous":
         status, reason = "blocked", "ambiguous_policy"
@@ -69,7 +70,11 @@ def expected(policy, approval, claim, callback):
                 status, reason = "dispatched", "host_dispatch_returned"
 
     return {
-        "policy": policy, "approval": approval, "claim": claim, "callback": callback,
+        "resource_scope": resource_scope, "proposal_resource": "team@example.test",
+        "policy_rule_resource": None if policy == "deny" and resource_scope == "exact" else (
+            "team@example.test" if resource_scope == "exact" else "outside@example.test"),
+        "policy": policy, "approval": approval,
+        "claim": claim, "callback": callback,
         "receipt": {"protocol": "aml-action-dispatch/1", "proposal_sha256": digest,
                     "policy_decision": decision, "execution_status": status, "reason": reason},
         "approval_requests": requests, "claim_attempts": attempts,
@@ -83,18 +88,18 @@ def verify(report):
     if (set(report) != {"protocol", "provenance", "limits", "axes", "rows"}
             or report.get("protocol") != "aml-action-dispatch-matrix/1"
             or report.get("provenance") != "project-authored bounded cross-product of local callbacks"
-            or report.get("limits") != "192 finite combinations. No human approval, provider call, delivery, arbitrary interleaving, or production safety proof."
+            or report.get("limits") != "384 finite combinations. No human approval, provider call, delivery, arbitrary interleaving, or production safety proof."
             or report.get("axes") != AXES):
         raise ValueError("matrix provenance, scope, protocol, or finite axes changed")
     vectors = list(itertools.product(*(AXES[key] for key in AXES)))
     rows = report.get("rows")
     if not isinstance(rows, list) or len(rows) != len(vectors):
         raise ValueError("matrix is missing or repeating vectors")
-    for index, ((policy, approval, claim, callback), observed) in enumerate(zip(vectors, rows)):
-        wanted = expected(policy, approval, claim, callback)
+    for index, ((resource_scope, policy, approval, claim, callback), observed) in enumerate(zip(vectors, rows)):
+        wanted = expected(resource_scope, policy, approval, claim, callback)
         if observed != wanted:
             difference = [key for key in wanted if observed.get(key) != wanted[key]]
-            raise ValueError(f"vector {index} ({policy}/{approval}/{claim}/{callback}) differs: {difference}")
+            raise ValueError(f"vector {index} ({resource_scope}/{policy}/{approval}/{claim}/{callback}) differs: {difference}")
     return {"protocol": "aml-action-dispatch-matrix-oracle/1", "vectors_verified": len(vectors),
             "oracle": "Python finite state expectation independent of the Node callback implementation",
             "scope": "Finite project-authored local fixtures; no formal, independent, or production proof"}
diff --git a/test/action-boundary-dispatch-matrix.test.js b/test/action-boundary-dispatch-matrix.test.js
index 96ae2c01..321f796e 100644
--- a/test/action-boundary-dispatch-matrix.test.js
+++ b/test/action-boundary-dispatch-matrix.test.js
@@ -11,12 +11,12 @@ const verify = value => spawnSync("python3", [oracle, "-"], {
   input: JSON.stringify(value), encoding: "utf8"
 });
 
-test("the 192 checked-in vectors are current and match the separate Python state oracle", async () => {
+test("the 384 checked-in vectors are current and match the separate Python state oracle", async () => {
   assert.deepEqual(report, await buildDispatchMatrix());
   assert.equal(report.rows.length, Object.values(axes).reduce((total, items) => total * items.length, 1));
   const result = verify(report);
   assert.equal(result.status, 0, result.stderr);
-  assert.equal(JSON.parse(result.stdout).vectors_verified, 192);
+  assert.equal(JSON.parse(result.stdout).vectors_verified, 384);
 });
 
 test("the oracle detects a false dispatch, missing callback, changed binding, and inflated claim", () => {
@@ -35,4 +35,7 @@ test("the oracle detects a false dispatch, missing callback, changed binding, an
   const inflatedClaim = altered();
   inflatedClaim.limits = "Formal proof of production safety";
   assert.notEqual(verify(inflatedClaim).status, 0);
+  const wrongResource = altered();
+  wrongResource.rows[240].receipt.policy_decision = "allow";
+  assert.notEqual(verify(wrongResource).status, 0);
 });
diff --git a/test/action-boundary-mutation-proof.test.js b/test/action-boundary-mutation-proof.test.js
index f624fb0e..82356d41 100644
--- a/test/action-boundary-mutation-proof.test.js
+++ b/test/action-boundary-mutation-proof.test.js
@@ -9,10 +9,11 @@ const checkedIn = JSON.parse(readFileSync(
 test("selected source mutations match the checked-in, source-bound report", async () => {
   assert.deepEqual(await buildDispatchMutants(), checkedIn);
   assert.deepEqual(checkedIn.summary, { selected_mutants: 7,
-    matrix_detected: 6, additional_probe_detected: 1, undetected: 0 });
-  assert.equal(checkedIn.matrix_vectors, 192);
-  assert.deepEqual(checkedIn.mutations.filter(row => row.matrix_changed_rows === 0)
-    .map(row => row.id), ["resource_wildcard"]);
+    matrix_detected: 7, additional_probe_detected: 0, undetected: 0 });
+  assert.equal(checkedIn.matrix_vectors, 384);
+  assert.deepEqual(checkedIn.mutations.filter(row => row.matrix_changed_rows === 0), []);
+  assert.equal(checkedIn.mutations.at(-1).matrix_changed_rows, 192);
+  assert.equal(checkedIn.mutations.at(-1).first_changed_vector.index, 192);
   assert.equal(checkedIn.mutations.at(-1).resource_probe_changed, true);
   assert.equal(checkedIn.mutations.at(-1).resource_probe_result.callback_count, 1);
 });
diff --git a/test/dispatch-matrix-view.test.js b/test/dispatch-matrix-view.test.js
index 25d46dc7..67a4a8ce 100644
--- a/test/dispatch-matrix-view.test.js
+++ b/test/dispatch-matrix-view.test.js
@@ -10,23 +10,30 @@ const page = readFileSync(new URL("../docs/dispatch-matrix.html", import.meta.ur
 const script = readFileSync(new URL("../docs/dispatch-matrix.js", import.meta.url));
 
 test("the atlas indexes every vector and filters the actual checked-in outcomes", () => {
-  assert.deepEqual(inspectMatrix(report), { blocked: 140, dispatched: 26, unknown: 26 });
+  assert.deepEqual(inspectMatrix(report), { blocked: 332, dispatched: 26, unknown: 26 });
   for (const [index, row] of report.rows.entries()) {
-    assert.equal(matrixIndex(row.policy, row.approval, row.claim, row.callback), index);
+    assert.equal(matrixIndex(row.policy, row.approval, row.claim, row.callback, row.resource_scope), index);
   }
-  assert.equal(visibleMatrixIndices(report).length, 192);
-  assert.equal(visibleMatrixIndices(report, "deny", "blocked").length, 48);
+  assert.equal(visibleMatrixIndices(report).length, 384);
+  assert.equal(visibleMatrixIndices(report, "deny", "blocked").length, 96);
   assert.equal(visibleMatrixIndices(report, "deny", "unknown").length, 0);
   assert.equal(visibleMatrixIndices(report, "requires_approval", "unknown").length, 2);
+  assert.equal(visibleMatrixIndices(report, "all", "blocked", "other").length, 192);
+  assert.equal(visibleMatrixIndices(report, "allow", "blocked", "other").length, 48);
   assert.deepEqual(matrixGroupSlots("requires_approval", "match",
     visibleMatrixIndices(report, "requires_approval", "unknown")),
     [null, 97, null, null, null, null, null, null], "filtering keeps callback and claim positions");
+  assert.deepEqual(matrixGroupSlots("allow", "match",
+    visibleMatrixIndices(report, "allow", "blocked", "other"), "other"),
+    [240, 241, 242, 243, 244, 245, 246, 247]);
   assert.throws(() => visibleMatrixIndices(report, "unknown_policy"), RangeError);
+  assert.throws(() => visibleMatrixIndices(report, "all", "all", "unlisted_scope"), RangeError);
 });
 
 test("the highlighted cases retain the side effects hidden by a one-word status", () => {
   assert.deepEqual(matrixInsights(report), {
-    spent_and_blocked: 8, unknown_after_write: 26, frozen_after_mutation: 2
+    spent_and_blocked: 8, unknown_after_write: 26, frozen_after_mutation: 2,
+    other_rule_blocked: 192
   });
   const spent = report.rows[100];
   assert.deepEqual([spent.receipt.execution_status, spent.claims_consumed, spent.callback_count],
@@ -40,8 +47,9 @@ test("the highlighted cases retain the side effects hidden by a one-word status"
   const url = matrixUrl("https://example.test/dispatch-matrix.html?policy=allow", 49, report);
   assert.equal(new URL(url).hash, "#case");
   assert.equal(matrixSelection(new URL(url).search, visibleMatrixIndices(report)), 49);
-  assert.equal(matrixSelection("?vector=192", visibleMatrixIndices(report, "allow")), 48);
-  assert.throws(() => matrixUrl(url, 192, report), RangeError);
+  assert.equal(matrixSelection("?vector=384", visibleMatrixIndices(report, "allow")), 48);
+  assert.equal(matrixSelection("?vector=240", visibleMatrixIndices(report, "all", "all", "other")), 240);
+  assert.throws(() => matrixUrl(url, 384, report), RangeError);
 });
 
 test("the viewer rejects malformed axes or totals and marks its evidence boundary", () => {
@@ -51,8 +59,9 @@ test("the viewer rejects malformed axes or totals and marks its evidence boundar
   const falseOutcome = structuredClone(report);
   falseOutcome.rows[0].receipt.execution_status = "dispatched";
   assert.throws(() => inspectMatrix(falseOutcome), /totals/);
-  assert.deepEqual(Object.keys(MATRIX_AXES), ["policy", "approval", "claim", "callback"]);
+  assert.deepEqual(Object.keys(MATRIX_AXES), ["resource_scope", "policy", "approval", "claim", "callback"]);
   for (const required of ["data-preset=\"100\"", "data-preset=\"49\"", "data-preset=\"136\"",
+    "data-preset=\"240\"", "resource-filter", "case-resource", "case-rule", "action-dispatch-mutants.json",
     "No human approval", "no human approval", "formal proof of production safety",
     "does not independently verify its provenance", "dispatch-matrix.js"]) {
     assert.match(page.toLowerCase(), new RegExp(required.toLowerCase()));