Evaluate scoped grants and exact action approvals

Advanced70 min

Implement authorize_action(action, grants, now, approved_hashes=()). Return allow, approval_required, or deny. Action is a JSON-compatible dictionary with actor, tenant, tool, resource, and args. Grants match the first four fields and contain expires_at and require_approval.

Your task

Require exactly the five action keys; the four identity fields must be nonempty strings and args must be a dictionary that serializes with JSON allow_nan=False. Invalid action or policy data raises ValueError.
Each grant has exactly actor, tenant, tool, resource, expires_at, and require_approval. Require finite numeric times excluding booleans and a boolean approval flag.
A grant matches only exact actor, tenant, tool, and resource values; no prefixes or wildcards are interpreted. A grant is active only when expires_at > now.
Return deny when no active grant matches. If any matching grant requires approval, combine matching grants restrictively and require approval.
Compute the approval hash as SHA-256 of UTF-8 JSON with sort_keys=True, separators=(comma, colon), and allow_nan=False. Return approval_required if the hash is absent from the trusted approved_hashes collection.
Do not execute the action. Treat the trusted hash collection as a teaching stand-in for authenticated approval records, not as an authentication protocol.

Examples

EXAMPLE 1

Inputauthorize_action(action, [grant], 10)

Output"approval_required"

The resource grant exists, but the reviewed payload hash is missing.

def authorize_action(action, grants, now, approved_hashes=()):
    raise NotImplementedError