{
  "id": "gate/deny-user-fn",
  "regime": "conformance",
  "profile": "GACS-E1",
  "claim": "table-policy",
  "harness": "query",
  "policy": "policies/sql-gate.json",
  "query": "SELECT app.pkg.fn(id) FROM public.customers",
  "rationale": "Serialization and dump aggregates are refused.",
  "doesNotTest": "Leakage through allowed aggregates such as count or avg.",
  "sourceVector": "test-vectors/sql-gate/vectors.json#deny-user-fn",
  "expect": "deny"
}