{
  "ad_accounts": [
    {
      "client_id": "client-colbec-hospitality",
      "external_reference": "redacted",
      "id": "adacc-demo-hospitality",
      "name": "Meta Ads Demo Hospitality",
      "platform": "meta",
      "tenant_id": "tenant-colbec"
    }
  ],
  "auth_contract": {
    "auth_mode": "synthetic_dev_preview",
    "authenticated": false,
    "role": "Client Viewer",
    "tenant_isolation_enforced_for_tokens": true,
    "token_configured": false,
    "write_routes_require_workspace_permission": true
  },
  "brands": [
    {
      "client_id": "client-colbec-hospitality",
      "id": "brand-mallorca-boutique",
      "market": "Mallorca",
      "name": "Mallorca Boutique Stay",
      "tenant_id": "tenant-colbec"
    }
  ],
  "clients": [
    {
      "id": "client-colbec-hospitality",
      "name": "Colbec Hospitality Demo",
      "tenant_id": "tenant-colbec"
    },
    {
      "id": "client-colbec-real-estate",
      "name": "Colbec Premium Real Estate Demo",
      "tenant_id": "tenant-colbec"
    }
  ],
  "execution_mode": "synthetic_demo_only",
  "next_actions": [
    "SSO/JWT Provider spaeter als Enterprise-Identity-Upgrade konfigurieren",
    "Private Workspace-Konfiguration aus Dokploy Secret Files oder Datenbank laden",
    "Stage-Read-Gates und Cross-Client-Blocker in Smokes halten"
  ],
  "principal": {
    "actor": "synthetic-demo-viewer",
    "auth_mode": "synthetic_dev_preview",
    "auth_required": false,
    "authenticated": false,
    "client_id": "client-colbec-hospitality",
    "issue": null,
    "permissions": [
      "action_log:read",
      "export:read",
      "import:read",
      "planning:read",
      "reporting:read",
      "workspace:read"
    ],
    "role": "Client Viewer",
    "schema_version": "workspace-auth.2026-06-11.v1",
    "tenant_id": "tenant-colbec",
    "token_configured": false
  },
  "role_matrix": [
    {
      "action_log": "write",
      "exports": "approve",
      "imports": "write",
      "planning": "write",
      "reporting": "approve",
      "role": "Owner",
      "settings": "write"
    },
    {
      "action_log": "write",
      "exports": "draft",
      "imports": "read",
      "planning": "write",
      "reporting": "write",
      "role": "Strategist",
      "settings": "none"
    },
    {
      "action_log": "read",
      "exports": "draft",
      "imports": "read",
      "planning": "read",
      "reporting": "write",
      "role": "Analyst",
      "settings": "none"
    },
    {
      "action_log": "read",
      "exports": "read",
      "imports": "read",
      "planning": "read",
      "reporting": "read",
      "role": "Client Viewer",
      "settings": "none"
    }
  ],
  "schema_version": "enterprise_tools.2026-06-11.v1",
  "selected_client_id": "client-colbec-hospitality",
  "tenant": {
    "id": "tenant-colbec",
    "name": "House of Colbec"
  },
  "tool": "enterprise_workspace",
  "workspace_gates": [
    {
      "gate": "auth",
      "note": "Token-/Rollenvertrag ist implementiert; Stage-Reads und Schreibpfade erzwingen Workspace-Permissions.",
      "status": "ready_stage"
    },
    {
      "gate": "tenant_isolation",
      "note": "Client-Auswahl wird gegen Workspace-Principal geprueft; Cross-Client-Zugriffe liefern 403.",
      "status": "ready_stage"
    },
    {
      "gate": "real_customer_data",
      "note": "dev-meta bleibt synthetic-only und verarbeitet keine echten Kundendaten.",
      "status": "locked"
    }
  ]
}