{"autheory_claims_source_boundaries":{"access_level":"derived from trusted provider staff permissions only","control_plane_access":"provider staff management metadata/grant source only","control_plane_access_level":"derived from trusted provider staff permissions only","control_plane_admin":"provider staff management permissions/grant source only","control_plane_role":"provider staff management role source only","control_plane_roles":"provider staff management role source only","control_plane_write":"provider staff management permissions/grant source only","is_staff":"provider staff management metadata/grant source only","membership_role":"verified account membership metadata only","membership_status":"verified account membership state only","organization_id":"trusted OAuth authorization code/session membership context or trusted resource-binding context","role":"provider staff role source only for control-plane responses","tenant_id":"trusted OAuth authorization code/session membership context or trusted resource-binding context"},"autheory_grant_protected_scopes":["mcp:tools","ai.kb.query","memory.append"],"autheory_scope_source_boundaries":{"autheory_grant_protected_scopes":"tenant/client/resource scopes that require explicit active ClientTenantAccessGrant rows","scopes_supported":"advertised provider-core vocabulary only; tenant/resource admission is not implied"},"authorization_endpoint":"https://auth.lab.autheory.app/oauth/authorize","claims_supported":["sub","aud","email","email_verified","name","given_name","family_name","picture","preferred_username","azp","sid","client_id","admission_ticket_ref","owner_user_ref","tenant_id","organization_id","membership_role","membership_status","organization_type","scope","ver","is_staff","control_plane_access","control_plane_write","control_plane_admin","control_plane_role","control_plane_roles","control_plane_access_level","role","access_level"],"id_token_signing_alg_values_supported":["RS256"],"issuer":"https://auth.lab.autheory.app","jwks_uri":"https://auth.lab.autheory.app/.well-known/jwks.json","response_types_supported":["code"],"scopes_supported":["openid","profile","email","offline_access","mcp:tools","ai.kb.query","memory.append"],"subject_types_supported":["public"],"token_endpoint":"https://auth.lab.autheory.app/auth/token","token_endpoint_auth_methods_supported":["none"],"userinfo_endpoint":"https://auth.lab.autheory.app/auth/userinfo"}