Conflict-of-Interest IAM Permissions Matrix

This document is GENERATED directly from src/schema/iam_policy.py. Do not edit manually.

Structural Invariant: Four Service Accounts & Four Conflict Boundaries

Rule: No Service Account may hold two permissions from {artist identity, buyer terms, evidence, revocation}.

Paired Positive Enforcement: Every cell asserting DENIED is tested alongside its corresponding PERMITTED operation in CI.

Agent Role	Service Account Email	Conflict Domain	Permitted Collections (Positive)	Denied Collections (Negative)
Rights Custodian	`rights-custodian-sa@hodi-2026.iam.gserviceaccount.com`	`identity`	`works` `artists` `control_proofs`	`buyer_terms` `crawler_access` `canaries` `revocation_notices` `revocation_outbox`
Licensing Negotiator	`licensing-negotiator-sa@hodi-2026.iam.gserviceaccount.com`	`buyer_terms`	`buyer_terms` (Requires filter: `counterparty_id`) `receipts` `grants` (Requires filter: `counterparty_id`)	`artists` `works` `crawler_access` `canaries` `revocation_notices` `revocation_outbox`
Evidence Agent	`evidence-agent-sa@hodi-2026.iam.gserviceaccount.com`	`evidence`	`crawler_access` `canaries` `evidence_records` `canary_hits` `verbatim_matches` `redistribution_findings` `accrual_audits`	`artists` `buyer_terms` `grants` `revocation_notices` `revocation_outbox`
Revocation Propagator	`revocation-propagator-sa@hodi-2026.iam.gserviceaccount.com`	`revocation`	`grants` `revocation_notices` `revocation_outbox`	`artists` `buyer_terms` `crawler_access` `canaries`
Consent Arbiter	`consent-arbiter-sa@hodi-2026.iam.gserviceaccount.com`	`adjudication`	`incidents` `incident_assertions` `negotiation_freezes`	`artists` `works` `control_proofs` `buyer_terms` `grants` `crawler_access` `canaries` `evidence_records` `revocation_notices` `revocation_outbox` `receipts`
Sandbox Agent	`sandbox-agent-sa@hodi-2026.iam.gserviceaccount.com`	`sandbox`	`demo_grants` `demo_revocation_notices` `demo_revocation_outbox` `demo_works` `demo_leases`	`grants` `works` `artists` `control_proofs` `buyer_terms` `crawler_access` `canaries` `evidence_records` `revocation_notices` `revocation_outbox` `receipts` `counterparty_credentials` `leases` `incidents`

Judge Verification (Under 30 Seconds)

Inspect src/schema/iam_policy.py and tests/test_*_iam.py to verify that each SA receives PERMISSION_DENIED on forbidden collections while successfully performing permitted operations.