{
  "status": "Proposed register, not live grants or verified provider calls",
  "job": "Weekly timesheet-to-summary report",
  "purposes": [
    {"purpose":"Read source T1","intendedOperations":["read values"],"candidateScope":"https://www.googleapis.com/auth/spreadsheets.readonly","capabilityCaveat":"Read capability is broader than T1; application file restriction is not provider scope restriction","technicalGrantId":"to be verified","ownerRole":"operations lead","authorisingAccount":"to be verified","lastSuccessfulRead":null,"credentialLocation":"secret-store reference only"},
    {"purpose":"Write destination R1","intendedOperations":["write summary values"],"candidateScope":"https://www.googleapis.com/auth/drive.file","capabilityCaveat":"Per-file app access can include edit/create/delete; not a write-one-range-only scope","technicalGrantId":"to be verified; may share grant with source purpose","ownerRole":"report owner","authorisingAccount":"to be verified","lastSuccessfulWrite":null,"credentialLocation":"secret-store reference only"}
  ],
  "retirementEvidenceRequired":["automated use stopped","affected purposes sharing grant identified","provider revocation recorded","permitted bounded access/refresh check rejected as expected","credential material removed under retention policy","remaining report marked static or stale"]
}