{
  "schema": 1,
  "note": "Sign bareOsPathCapabilityPayloadCanonicalUtf8(payload) with Ed25519; set pubkeyHex (64 hex) and signatureHex (128 hex). Inner payload fields: prefix (absolute path prefix), ops (include read or all), optional expMs (epoch ms). Store on a file as xattr user.bareos.cap_v1 = base64(JSON.stringify(this object)) via /bin/xattr -w. Enable enforcement: BARE_OS_PATH_CAPABILITY_ENFORCE_READ=1 and BARE_OS_PATH_CAPABILITY_PREFIX=/home/",
  "pubkeyHex": "REPLACE_WITH_SIGNER_PUBLIC_KEY_64_HEX_CHARS",
  "signatureHex": "REPLACE_WITH_SIGNATURE_OVER_CANONICAL_PAYLOAD_128_HEX_CHARS",
  "payload": {
    "expMs": 1893456000000,
    "ops": ["read"],
    "prefix": "/home/guest/"
  }
}