Module decision 

The per-request authorization decision record (the audit hook point).

Every PDP-gated op produces exactly one DecisionRecord: the broker decides (subject, op, key) -> Allow|Deny (via crate::catalog::pdp::Pdp), builds a record, and logs it structurally with tracing. This is the single place a decision is materialized; vault-vq5 will persist these records to a JSONL audit file by hooking DecisionRecord::record (or reusing the fields it carries). This module deliberately does not open or write any file.

A record never carries secret bytes, only the policy generation id it was decided against, the actor subject, presenter summary, op, key name, outcome, and reason.

Structs

DecisionRecord

A structured record of one authorization decision (the audit hook point).

Enums

Outcome

The outcome of a gated request, in audit-friendly form.

Functions

op_token

The stable wire spelling for a broker policy op (delegates to Op::token, the single source of truth for the op→token mapping).