{
  "schema_version": "2",
  "scenario_id": "mail-draft-assistant-vulnerable",
  "purpose": "Read one email and draft a reply; never send automatically.",
  "non_goals": ["send messages", "modify mailbox state", "persist email content to memory"],
  "assets": [
    {"id": "private_mail", "classification": "restricted"},
    {"id": "mailbox_identity", "classification": "confidential"},
    {"id": "audit_trace", "classification": "internal"}
  ],
  "trust_boundaries": [
    {"id": "email-to-agent", "from": "external_sender", "to": "agent_context", "data_assets": ["private_mail"]},
    {"id": "agent-to-mail-service", "from": "agent_runtime", "to": "external_mail", "data_assets": ["private_mail", "mailbox_identity"]}
  ],
  "untrusted_sources": [
    {"id": "email_body", "type": "message", "trust_level": "untrusted"},
    {"id": "attachment_text", "type": "document", "trust_level": "untrusted"}
  ],
  "identities": [
    {"id": "shared-mail-service", "shared": true, "ttl_minutes": 1440, "scopes": ["mail.read", "mail.send"]}
  ],
  "tools": [
    {"name": "read_mail", "mode": "read", "destination_class": "internal", "endpoint": "mail-service-api", "resources": ["mailbox:self/messages"], "side_effect": false, "required_for_purpose": true, "required_scopes": ["mail.read"], "identity_id": "shared-mail-service", "egress_assets": []},
    {"name": "send_mail", "mode": "write", "destination_class": "external", "endpoint": "mail-service-api", "resources": ["recipient:attacker.example"], "side_effect": true, "required_for_purpose": false, "required_scopes": ["mail.send"], "identity_id": "shared-mail-service", "egress_assets": ["private_mail"]}
  ],
  "dependencies": [
    {"name": "mail-connector", "version": "latest", "artifact_digest": null, "provenance_verified": false}
  ],
  "memory": {"enabled": true, "write_sources": ["email_body", "attachment_text"], "write_assets": ["private_mail"]},
  "controls": {
    "treat_external_content_as_data": false,
    "tool_allowlist": ["read_mail", "send_mail"],
    "endpoint_allowlist": [],
    "resource_allowlist": [],
    "approval": {"required_for_tools": [], "binds_parameters": false, "expires_minutes": 60},
    "sandbox": {"enabled": false, "network_default_deny": false},
    "output_validation": false,
    "data_egress_validation": false,
    "memory_write_validation": false,
    "audit_logging": false,
    "rate_limit": false,
    "emergency_disable": false
  },
  "risk_policy": {
    "block_severities": ["critical", "high"],
    "review_severities": ["medium"],
    "accept_severities": ["low"]
  }
}