{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://mandateshield.com/schemas/execution-assurance-level-v1.json",
  "title": "MandateShield Execution Assurance Level v1",
  "description": "Canonical vocabulary that separates local deployment evidence from external facilitator- or provider-mandatory enforcement. A higher label may be used only when every lower operational control and the level-specific evidence are present.",
  "type": "string",
  "enum": [
    "UNVERIFIED",
    "SDK_ONLY",
    "CREDENTIAL_ISOLATED",
    "EGRESS_ENFORCED",
    "PROVIDER_ATTESTED",
    "FACILITATOR_ENFORCED",
    "PROVIDER_ENFORCED"
  ],
  "x-mandateshield-levels": [
    {
      "level": "UNVERIFIED",
      "evidence_boundary": "No valid Gate deployment evidence has been established.",
      "external_enforcement_claim": false
    },
    {
      "level": "SDK_ONLY",
      "evidence_boundary": "The Gate SDK is declared present; isolation and durable enforcement are not established.",
      "external_enforcement_claim": false
    },
    {
      "level": "CREDENTIAL_ISOLATED",
      "evidence_boundary": "Processor and provider credentials, audience and environment are declared isolated.",
      "external_enforcement_claim": false
    },
    {
      "level": "EGRESS_ENFORCED",
      "evidence_boundary": "The customer deployment declares durable consume-once state and blocked direct provider egress.",
      "external_enforcement_claim": false
    },
    {
      "level": "PROVIDER_ATTESTED",
      "evidence_boundary": "The first-party Doctor accepted supplied provider lookup, webhook and receipt-key evidence. This remains deployment evidence, not provider-mandatory enforcement.",
      "external_enforcement_claim": false
    },
    {
      "level": "FACILITATOR_ENFORCED",
      "evidence_boundary": "One identified facilitator independently requires and redeems the exact permit and rejects permitless operations.",
      "external_enforcement_claim": true
    },
    {
      "level": "PROVIDER_ENFORCED",
      "evidence_boundary": "One identified payment provider independently requires and redeems the exact permit and rejects permitless operations.",
      "external_enforcement_claim": true
    }
  ],
  "x-mandateshield-current-general-external-enforcement-claim": null,
  "x-mandateshield-independent-certification": false
}