# PBS isolation proof — token c10@pbs!box (secret redacted, never echoed)
# DooPlex PBS https://localhost:8007   2026-07-31T20:14:40Z
# ACL: c10@pbs and c10@pbs!box hold DatastoreBackup on /datastore/felhom-c10 ONLY.
# felhom-spike (production, demo-felhom's backups) carries NO grant for this auth-id.

## POSITIVE CONTROL — same token, its OWN datastore (must SUCCEED, else the 403s below prove nothing)
$ GET /api2/json/admin/datastore/felhom-c10/snapshots
{"data":[]}
HTTP 200

## DENIAL 1 — list snapshots of PRODUCTION datastore felhom-spike
permission check failed - missing Datastore.Audit|Datastore.Backup on /datastore/felhom-spike
HTTP 403

## DENIAL 2 — list NAMESPACES of felhom-spike
permission check failed
HTTP 403

## DENIAL 3 — DELETE namespace demo-felhom in felhom-spike (destructive)
permission check failed - missing Datastore.Modify on /datastore/felhom-spike
HTTP 403

## DENIAL 4 — status of felhom-spike
permission check failed
HTTP 403