Crate gatekeep 

Code-first authorization primitives for deterministic Rust policy evaluation.

Human guides and reference material are in the docs/ directory of the repository. API reference: https://docs.rs/gatekeep.

Modules

condition

Condition builder helpers.

policy

Policy builder helpers.

Structs

AuditEntry

Durable audit payload for a decision.

ClauseLabel

Owned gatekeep identifier.

Context

Request-scoped data passed to adapter boundaries.

Decision

Structured policy decision with obligations and a typed trace.

DecisionSummary

Monomorphic observer payload for a decision.

DecisionTrace

Typed trace produced by pure evaluation.

DenialReason

Stable denial reason emitted by the core.

FactId

Owned gatekeep identifier.

IdentityReasonCatalog

Reason catalog that renders the stable reason code.

KnownFacts

Fact bundle accepted by full evaluation.

Locale

Language or locale tag used by human-facing reason text.

Lowered

Backend filter and grade projection produced by query lowering.

NoopAuditSink

Audit sink that discards entries.

NoopPolicyObserver

Observer that discards decision summaries.

ObligationId

Owned gatekeep identifier.

ParamKey

Owned gatekeep identifier.

PartialFacts

Fact bundle accepted by partial evaluation.

PolicyAnchor

Stable policy identity recorded with summaries and audit entries.

PolicyHash

Owned gatekeep identifier.

PolicyId

Owned gatekeep identifier.

ReasonCode

Owned gatekeep identifier.

RequestId

Owned gatekeep identifier.

StaticClauseLabel

Static gatekeep identifier.

StaticFactId

Static gatekeep identifier.

StaticObligationId

Static gatekeep identifier.

StaticParamKey

Static gatekeep identifier.

StaticReasonCode

Static gatekeep identifier.

StaticRequestId

Static gatekeep identifier.

StaticSubjectSlot

Static gatekeep identifier.

StaticTenantId

Static gatekeep identifier.

SubjectRef

Application-owned subject reference.

SubjectSlot

Owned gatekeep identifier.

TenantId

Owned gatekeep identifier.

Trace

Durable, non-generic decision trace.

Enums

Condition

Boolean predicate over known or deferred facts.

DecisiveClause

Typed decisive clause.

DenyShape

Disclosure shape for a denied grant.

Effect

Permit or deny effect produced by evaluation.

EffectKind

Permit/deny effect without the generic outcome value.

GatekeepError

Validation errors returned by typed gatekeep records.

LowerError

Error returned by query-lowering adapters.

Policy

Reified authorization policy.

Presence

Presence state of a named fact.

ReasonValue

Structured denial-reason parameter value.

Residual

Result of partial evaluation with possibly unknown facts.

ResidualPolicy

Residual policy produced by partial evaluation.

ResidualPolicyBranch

Child branch considered by ResidualPolicy::try_fold_pruned.

ResidualPolicyNode

Fold node exposed by ResidualPolicy::try_fold.

ResolveError

Error returned by fact resolution orchestration.

TraceClause

Serialized decisive clause.

TraceError

Error produced while serializing trace or reason values.

Traits

AuditSink

Append-only audit boundary.

Fact

Marker trait for compile-time known facts.

FactResolver

Async boundary that resolves policy facts from application-owned storage.

Lattice

Outcome ordering used when policies combine permissions.

ObligationSpec

Marker trait for compile-time known obligations.

PolicyObserver

Side-channel observer for decision summaries.

QueryLowering

Lowers a residual policy into a backend filter and grade projection.

ReasonCatalog

Presentation adapter for localized denial reasons.

Functions

complete_residual

Completes a partial-evaluation result against known facts.

evaluate

Evaluates a policy against known facts.

evaluate_residual

Evaluates a residual policy against known facts.

partial_evaluate

Partially evaluates a policy against present, absent, and unknown facts.

required_facts

Returns every fact that may be consulted by a policy.

required_residual_facts

Returns every fact that may be consulted by a residual policy.

Type Aliases

GatekeepResult

Result type used by gatekeep constructors and validators.

TraceValue

Opaque serialized value used only for trace and audit output.