- name: verified-token-write-scope
  where: "orders.ts"
  ensure: >-
    The cancellation handler must reject a verified token without orders:write before invoking cancelOrder.