{
  "id": "check:ops-warden-ci-deploy-agent-agt",
  "tenant": "tenant:platform",
  "subject": {
    "id": "ci-deploy-agent",
    "type": "agt"
  },
  "action": "sign",
  "resource": {
    "id": "ssh-cert:actor/ci-deploy-agent",
    "type": "ssh-certificate",
    "system": "ops-warden"
  },
  "context": {
    "principals": [
      "deploy"
    ],
    "actor_type": "agt",
    "ttl_hours": 1,
    "pubkey_fingerprint": "SHA256:example-agt-fingerprint"
  }
}