Module catalog 

Catalog + policy schema, loader, and resolution (design catalog-policy-schema.html).

The broker loads two exported JSON documents at startup:

• a catalog (schema): the key inventory + backend routing table (§2);
• a policy (policy): the authorization allow-list + the export-resolved name/membership tables (§3, §4).

load parses and validates both (§5’s full hard-error list), then builds a ResolvedPolicy allow-index. Per-request AuthenticatedActor authorization is handled by the pdp::Pdp engine, which consumes that index plus the catalog and config. Default-deny is the absence of a matching grant: this module only carries the allows.

Glob matching (glob) is the load-bearing §3.4 semantics: wildcards are last-position only, * matches exactly one segment, ** matches one-or-more.

Re-exports

pub use glob::GlobError;

pub use glob::GlobSeg;

pub use glob::KeyGlob;

pub use loader::LoadError;

pub use loader::LoadWarning;

pub use loader::RawPolicy;

pub use loader::RawRule;

pub use loader::RawSubjectDefinition;

pub use loader::load;

pub use pdp::ADMIN_EXPLAIN_TARGET;

pub use pdp::ADMIN_RELOAD_TARGET;

pub use pdp::ADMIN_REVOKE_TARGET;

pub use pdp::ADMIN_WATCH_TARGET;

pub use pdp::AllowVia;

pub use pdp::Decision;

pub use pdp::DenyReason;

pub use pdp::EffectiveGrant;

pub use pdp::Explanation;

pub use pdp::MatchedRule;

pub use pdp::Pdp;

pub use policy::ActionTerm;

pub use policy::ActionTermError;

pub use policy::Config;

pub use policy::Grant;

pub use policy::NameTable;

pub use policy::Op;

pub use policy::PrincipalSpec;

pub use policy::ResolvedPolicy;

pub use policy::ResolvedRule;

pub use policy::Rule;

pub use policy::SignatureKeyAlgorithm;

pub use policy::SubjectDefinition;

pub use policy::SubjectMatch;

pub use policy::SubjectName;

pub use schema::BackendKind;

pub use schema::BackendRef;

pub use schema::Capability;

pub use schema::Catalog;

pub use schema::Class;

pub use schema::Engine;

pub use schema::GenerateSpec;

pub use schema::KeyAlgorithm;

pub use schema::KeyEntry;

pub use schema::Labels;

pub use schema::MissingPolicy;

Modules

glob

Key-glob parsing and matching (design §3.4).

loader

Loader: parse + validate the exported catalog & policy JSON, and build the ready-for-PDP ResolvedPolicy index (design §5, §6).

pdp

Policy decision point (PDP) for per-request AuthenticatedActor authorization. This is vault-1l8.

policy

Policy schema: the authorization allow-list and the export-resolved config tables.

schema

Catalog schema types: the key inventory + backend routing table (design §2).