{
  "policy_check_version": "aux-receipt-policy-check-0.1.0",
  "endpoint": "https://api.aux.prdictionedge.ai/v1/certifications/policy-check",
  "purpose": "Let a downstream agent, auditor, insurer, or workflow engine verify a signed AUX certification and apply its own bounded acceptance policy without executing the consequential action.",
  "required": [
    "certification",
    "policy.policy_id",
    "policy.allowed_profiles",
    "policy.max_age_seconds"
  ],
  "policy_shape": {
    "policy_id": "non-empty string",
    "allowed_profiles": [
      {
        "profile_id": "string",
        "versions": [
          "profile version strings"
        ]
      }
    ],
    "max_age_seconds": "integer from 1 through 604800",
    "required_requirement_ids": [
      "optional requirement ids that must be satisfied in the receipt"
    ],
    "expected_certification_id": "optional exact certification_id",
    "expected_proposal_hash": "optional exact 64-hex proposal hash",
    "expected_evidence_set_hash": "optional exact 64-hex evidence-set hash"
  },
  "outcomes": [
    "ACCEPT",
    "REJECT",
    "INVALID_RECEIPT"
  ],
  "rule": "AUX first verifies the certification signature and integrity commitments. A valid receipt is then evaluated only against the caller-supplied acceptance policy. The result binds a SHA-256 policy hash, and AUX never executes the underlying action."
}