authorization-scope = {
  "apk": bstr,                    ; RFC 9679 thumbprint, SHA-256
  "code": software-identity,
  "limits": spending-limits,
  "expiry": uint,                 ; epoch seconds
  ? "rails": [+ tstr],            ; namespace: rail profiles
  ? "payees": [+ tstr],           ; namespace: rail profiles
  ? "executor": tstr,             ; REQUIRED with an aggregate bound
  ? "on_indeterminate": on-indeterminate,
  ? "crit": [+ tstr],
  * tstr => any                   ; unknown; refused if named in crit
}

software-identity = {
  "alg": tstr,                    ; e.g. "sha-256", "sha-384"
  "artifact": tstr,               ; measured-artifact class, from the
                                  ; attestation-technology profile
  "digest": bstr
}

spending-limits = {
  "currency": tstr,               ; asset identifier
  "scale": uint,                  ; smallest-unit scale declaration
  "per_payment": uint,            ; integer count of smallest unit
  ? "aggregate": uint,
  ? "window": uint                ; rolling seconds ending at
                                  ; evaluation time; REQUIRED with
                                  ; "aggregate"
}

on-indeterminate = {
  "mode": "hold" / "bounded-fail-open",
  ? "deadline": uint              ; epoch seconds; MUST NOT exceed
                                  ; "expiry"; meaningful for "hold"
}