{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://adcontextprotocol.org/schemas/3.2.0-beta.0/core/brand-response-authorization-result.json",
  "title": "Brand Response Authorization Result",
  "description": "Verifier-local result of the additive 3.2 brand.json authorization cross-check for a cryptographically valid verify_brand_claim or verify_brand_claims signed response. This object is produced by the verifier and is not a field asserted by the responding brand agent.",
  "type": "object",
  "properties": {
    "trust": {
      "type": "string",
      "enum": [
        "trusted",
        "untrusted"
      ],
      "description": "Whether the signing key was bound to the asserted brand_domain through an authorized brand-agent entry. An untrusted result MUST NOT extend or revoke relationship trust on its own."
    },
    "reason": {
      "type": "string",
      "enum": [
        "brand_json_unavailable",
        "agent_not_authorized",
        "agent_authorization_ambiguous",
        "jwks_unavailable",
        "kid_not_authorized",
        "kid_authorization_ambiguous",
        "key_material_mismatch",
        "key_purpose_invalid"
      ],
      "description": "Machine-readable reason for an untrusted result."
    },
    "kid": {
      "type": "string",
      "minLength": 1,
      "description": "JWS kid evaluated by the cross-check."
    },
    "jwks_uri": {
      "type": "string",
      "format": "uri",
      "pattern": "^https://",
      "description": "JWKS URI selected only from the matched brand.json agent entry, or its same-origin default."
    }
  },
  "required": [
    "trust"
  ],
  "oneOf": [
    {
      "properties": {
        "trust": {
          "type": "string",
          "const": "trusted"
        }
      },
      "required": [
        "trust",
        "kid",
        "jwks_uri"
      ],
      "not": {
        "required": [
          "reason"
        ]
      }
    },
    {
      "properties": {
        "trust": {
          "type": "string",
          "const": "untrusted"
        }
      },
      "required": [
        "trust",
        "reason"
      ]
    }
  ],
  "additionalProperties": false
}