{"policy_version":"1.1.0","rails":"fightmed_agent_rails_v1","flow":["1. GET /api/agent-rails/policy — read scopes and requirements","2. POST /api/agent-rails/challenge — X-Agent-Key → nonce","3. POST /api/agent-rails/attest — {nonce} + X-Agent-Key → rails_token","4. Call protected routes with X-Agent-Rails header"],"scopes":{"figures:read":"Aggregate dispute metrics (w/r/p, savings)","registry:read":"Cited CPT reference prices with proof blocks","provider:read":"Redacted provider negotiation stats (no PII)","integrity:read":"Reference chart staleness and citation health","audit:read":"Figure change audit log"},"protected_routes":{"/api/registry":["registry:read"],"/api/provider/{npi}":["provider:read"],"/api/data-integrity":["integrity:read"],"/api/figure-changes":["audit:read"]},"public_routes":["/","/api/readme","/api/figures","/reference","/.well-known/ai-plugin.json","/.well-known/agent-card.json","/api/openapi.json","/api/agent-rails/policy"],"headers":{"agent_key":"X-Agent-Key","agent_rails":"X-Agent-Rails"},"rate_limits":{"default_rpm":120,"reference_rpm":300},"proof_required":true,"pii_policy":"aggregate_only","naming":{"agent_rails":"Auth + permission rails","agent_tools":"Callable HTTP/MCP tools","agent_structures":"Schemas and manifests"}}