Module permissions 

Permission-gate helpers used across the write-path routers.

OSS keeps only the trait-based AclDb shim. The blanket impl AclDb for DatabaseConnection, the full 8-step PermissionsRepository::user_can resolution (tenants.md §5.1), and the permissions router live in the closed cognee-http-cloud / cognee-access-control crates.

REQUIRE_AUTHORIZATION=false|0|no short-circuits to Ok(()) (Python’s ENABLE_BACKEND_ACCESS_CONTROL=false parity). When the env var is left at its default and no acl_db is wired on the ComponentHandles (the pure-OSS case), permission checks pass through — there is no ACL backend to consult.

Functions

check_permission_via_handles

Dispatch on the ComponentHandles: when an acl_db impl is wired (closed builds), delegate to it; otherwise allow the operation because OSS does not bundle an ACL backend.

is_authorization_required

Returns true when authorization is required (i.e. not explicitly disabled).