{
  "bypass_waiver_id": null,
  "decision": "allow",
  "decision_at": "2025-12-02T00:00:00Z",
  "decision_reason": "surface cache fresh",
  "graph_revision_id": "graph-r1",
  "ledger_id": "ledger-789",
  "manifest_pointer": "surfacefs://cache/sha256:abc",
  "monotonic_nanos": 2233445566,
  "namespace": "prod",
  "payload": {
    "images": [
      {
        "digest": "sha256:abcd",
        "name": "ghcr.io/acme/api:1.2.3",
        "sbom_referrer": true,
        "signed": true
      }
    ],
    "manifest_pointer": "surfacefs://cache/sha256:abc",
    "policy_hash": "sha256:deadbeef",
    "verdict": "allow"
  },
  "payload_hash": "sha256:36bfb2bc81b7050bbb508e12cafe7ad5a51336aad397ef3a23b0e258aed73dc6",
  "policy_hash": "sha256:deadbeef",
  "project_id": "proj-123",
  "replay_manifest": "manifest-r1",
  "request_uid": "abcd-1234",
  "resource_kind": "Deployment",
  "side_effect": "none",
  "signature": "dsse://webhook-admissions/2025-12-02/webhook_admissions.ndjson.dsse#line1",
  "tenant_id": "tenant-a",
  "workload_name": "api"
}