Crate blindplane_access 

Signed enterprise access control for Blindplane.

This crate provides application-neutral principals, administrator-signed role-key grants, default-deny capability policies, signed revocation state, and audit events encrypted for both an owning user and tenant administrators. Callers supply trusted issuer keys, current time, persistence, and identity onboarding. The library performs no network I/O and never treats an embedded issuer key as trusted by itself.

Private-key operations and audit-event sealing are enabled by the default client feature. Disable default features for a server-safe build that can decode and validate signed access objects but cannot open role grants.

Run cargo run -p blindplane-access --example enterprise_access for a complete user/admin flow.

Structs

AccessGrant

Canonical signed grant carrying one HPKE-wrapped role secret.

AccessIssuer

Client-held tenant issuer signing key.

AccessValidationPolicy

Bounds applied while decoding untrusted access objects.

AuditContext

Clear routing fields authenticated by both record signature and payload AEAD.

AuditEvent

Full encrypted event content visible to the owning user and tenant administrators.

CapabilityRule

One exact capability rule.

GrantSpec

Inputs signed into a role-key grant.

Permissions

Permissions carried by a role-key grant.

PolicySpec

Inputs signed into one tenant policy.

Principal

Public identity and key descriptor for an access subject.

PrincipalKeypair

Client-held encryption and signing keys for one principal.

RevocationSpec

Monotonic floors signed into a revocation state.

RevocationState

Signed epoch floors for one (tenant, subject, scope) tuple.

RoleKeypair

Client-held X25519 role key used as a sealed-record recipient.

TenantPolicy

Canonical administrator-signed capability policy for one subject.

TrustedIssuer

A pinned issuer descriptor supplied through an authenticated channel.

VerifiedPolicy

A policy that passed trust, routing, freshness, epoch, and time checks.

VerifiedRevocation

Revocation state that passed issuer and tuple verification.

Enums

AccessError

A structural, trust, policy, or cryptographic access failure.

AuditEventKind

Kind of encrypted enterprise audit event.

CapabilityKind

Capability namespace interpreted by an embedding adapter.

Decision

Result of evaluating a verified capability policy.

Effect

Signed rule effect.

PrincipalKind

The endpoint represented by a principal descriptor.

Constants

ACCESS_FORMAT_VERSION

Canonical access-object format version.

Functions

open_audit_event

Open and context-check an event using either its subject role or tenant admin role.

seal_audit_event

Seal an event for exactly its subject role and the tenant administrator role.