Module authorizing 

Available on crate feature auth only.

Per-tool authorization for secret access.

A tool holding a context can name any secret, and a SecretProvider receives only that name. Policy therefore collapses to whatever the backing cloud credentials can read, and nothing distinguishes a weather tool asking for its own API key from the same tool asking for a payment credential.

AuthorizingSecretService closes that at the ADK layer: a declarative grant per tool decides before the provider is called, and every decision is recorded without the secret value.

Structs

AuthorizingSecretService

Wraps a SecretService with declarative per-tool grants and an audit record.

SecretAccessDecision

A single allow or deny, carrying no secret value.

SecretGrant

What a single tool may read.

Traits

SecretAuditSink

Records secret access decisions.