{
  "reporting_period": "2026-07",
  "agency_ministry": "LTA_MOT",

  "submission": {
    "endpoint": "https://piam-metrics.central.example.com/api/v1/submissions",
    "_note": "HTTPS only. The bearer token is NOT stored here — export PIAM_SUBMIT_TOKEN in the environment when submitting."
  },

  "_help": "total_privileged_accounts is taken from the discovery pipeline's summary.json. The six values below are owned by other teams; enter them as counts and the builder computes the percentages so they are auditable. Extra keys are ignored.",

  "inputs": {
    "privileged_access_incidents": 0,
    "_privileged_access_incidents_owner": "SecOps / incident management (count this period)",

    "pam_managed_privileged_accounts": 0,
    "_pam_managed_owner": "PAM tool (CyberArk/BeyondTrust/etc.) — count of privileged accounts under management; % = this / total_privileged_accounts",

    "managed_account_bypass": 0,
    "_managed_account_bypass_owner": "PAM bypass detection — count of privileged sessions/logins that skipped the vault this period",

    "break_glass_instances": 0,
    "_break_glass_owner": "Emergency-access (break-glass) logs — count of activations this period",

    "offboarding": {
      "offboarded_within_sla": 0,
      "offboarded_total": 0,
      "_owner": "HR/IAM — leavers whose privileged access was revoked within the SLA vs total leavers; % = within_sla / total"
    },

    "piam_training": {
      "people_trained": 0,
      "people_in_scope": 0,
      "_owner": "Training/LMS — people who completed PIAM training vs people in scope; % = trained / in_scope"
    }
  }
}