{
  "feature_id": "POS-004",
  "agent": "security",
  "stage": "security_gate",
  "verdict": "APPROVED",
  "summary": "Admin routes require 'admin' role. Terminal routes require 'admin'/'pos_manager'/'pos_cashier'. All DB queries parameterized. x-terminal-id header used but validated as UUID.",
  "checks": [
    {"item": "Authentication", "ok": true, "evidence": "requireRole/admin for admin; requireAnyRole for terminal"},
    {"item": "Parameterized queries", "ok": true, "evidence": "All pool.query uses $1, $2 placeholders"},
    {"item": "No new secrets", "ok": true, "evidence": "No env vars added"}
  ],
  "issues": []
}