kirino 0.6.3

Zero-trust authentication and authorization framework with RBAC and dynamic risk assessment.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use std::fmt;

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
pub enum AutonomyLevel {
    L0Frozen = 0,
    L1Assisted = 1,
    L2SemiAutonomous = 2,
    L3Conditional = 3,
    L4FullAutonomy = 4,
}

impl fmt::Display for AutonomyLevel {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            AutonomyLevel::L0Frozen => write!(f, "L0-Frozen"),
            AutonomyLevel::L1Assisted => write!(f, "L1-Assisted"),
            AutonomyLevel::L2SemiAutonomous => write!(f, "L2-SemiAutonomous"),
            AutonomyLevel::L3Conditional => write!(f, "L3-Conditional"),
            AutonomyLevel::L4FullAutonomy => write!(f, "L4-FullAutonomy"),
        }
    }
}

impl AutonomyLevel {
    #[must_use]
    pub fn is_operational(&self) -> bool {
        *self >= AutonomyLevel::L2SemiAutonomous
    }
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum Strategy {
    Allow { auto_approve: bool },
    Throttle { max_rate_per_min: u32 },
    RequireConfirmation,
    Block { reason: String },
}

impl fmt::Display for Strategy {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Strategy::Allow { auto_approve } => {
                write!(f, "Allow(auto_approve={auto_approve})")
            }
            Strategy::Throttle { max_rate_per_min } => {
                write!(f, "Throttle(max={max_rate_per_min}/min)")
            }
            Strategy::RequireConfirmation => write!(f, "RequireConfirmation"),
            Strategy::Block { reason } => write!(f, "Block({reason})"),
        }
    }
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SubScores {
    pub delegator_weight: f64,
    pub trust_penalty: f64,
    pub sensitivity: f64,
    pub domain_mismatch: f64,
    pub anomaly: f64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RiskScore {
    pub value: f64,
    pub sub_scores: SubScores,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ActionOutcome {
    Success,
    Failure { error: String },
    PolicyViolation { rule: String },
    Anomalous { deviation: f64 },
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuthorizationVerdict {
    pub allowed: bool,
    pub autonomy_level: AutonomyLevel,
    pub risk_score: f64,
    pub sub_scores: SubScores,
    pub evidence: Vec<String>,
    pub mitigation: Option<Strategy>,
    pub timestamp: DateTime<Utc>,
}

impl AuthorizationVerdict {
    #[must_use]
    pub fn denied(level: AutonomyLevel, risk: f64, sub_scores: SubScores, reason: &str) -> Self {
        Self {
            allowed: false,
            autonomy_level: level,
            risk_score: risk,
            sub_scores,
            evidence: vec![reason.to_string()],
            mitigation: Some(Strategy::Block {
                reason: reason.to_string(),
            }),
            timestamp: Utc::now(),
        }
    }
}