The authorization response must contain only requested scopes that policy actually grants. Implement the reduction so duplicate requests and unmatched permissions cannot widen access.
Build the implementation in Go under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has requested scope strings and grants. A scope is lowercase ASCII letters for namespace, a colon, then lowercase ASCII letters for action. Grants may be exact scopes or namespace:*; global * is invalid. Return sorted unique requested scopes covered by any grant. Reject malformed requests and grants. Wildcards match actions only within the exact namespace.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.