Crate gatekeep 

Code-first authorization primitives for deterministic Rust policy evaluation.

Human guides and reference material are in the docs/ directory of the repository. API reference: https://docs.rs/gatekeep.

Modules

condition

Condition builder helpers.

policy

Policy builder helpers.

Structs

ApplicationVerifiedTenantBinding

An application-verified tenant binding with an explicit validity window.

AuditEntry

Durable audit payload for a decision.

BindingProvenance

Bounded application-supplied provenance for a tenant or resolver binding.

ClauseLabel

Owned gatekeep identifier.

Context

Request-scoped data passed to adapter boundaries.

Decision

Structured policy decision with obligations and a typed trace.

DecisionAuditId

Owned gatekeep identifier.

DecisionAuditOccurrence

The stable identity and authoritative occurrence time for one decision.

DecisionSummary

Monomorphic observer payload for a decision.

DecisionTrace

Typed trace produced by pure evaluation.

DenialReason

Stable denial reason emitted by the core.

EvidenceDigest

Fixed-size digest carried as evidence without retaining raw claims or tokens.

FactId

Owned gatekeep identifier.

FactResolution

One atomic result from a fact resolver.

FactResolutionEvidence

Bounded evidence for the complete resolved fact set used by one decision.

FactResolutionMetadata

Resolver metadata supplied by an application for one fact-set observation.

IdentityReasonCatalog

Reason catalog that renders the stable reason code.

KnownFacts

Fact bundle accepted by full evaluation.

Locale

Language or locale tag used by human-facing reason text.

Lowered

Backend filter and grade projection produced by query lowering.

NoopAuditSink

Audit sink that discards entries.

NoopPolicyObserver

Observer that discards decision summaries.

ObligationId

Owned gatekeep identifier.

ParamKey

Owned gatekeep identifier.

PartialFacts

Fact bundle accepted by partial evaluation.

PolicyAnchor

Stable policy identity recorded with summaries and audit entries.

PolicyHash

Owned gatekeep identifier.

PolicyId

Owned gatekeep identifier.

ReasonCode

Owned gatekeep identifier.

RequestId

Owned gatekeep identifier.

StaticClauseLabel

Static gatekeep identifier.

StaticFactId

Static gatekeep identifier.

StaticObligationId

Static gatekeep identifier.

StaticParamKey

Static gatekeep identifier.

StaticReasonCode

Static gatekeep identifier.

StaticRequestId

Static gatekeep identifier.

StaticSubjectSlot

Static gatekeep identifier.

StaticTenantId

Static gatekeep identifier.

SubjectRef

Application-owned subject reference.

SubjectSlot

Owned gatekeep identifier.

SystemClock

Clock implementation that reads the system UTC wall clock.

TenantBindingEvidence

Bounded evidence for an application-verified tenant binding.

TenantId

Tenant routing identity shared with Dovecote’s 255-byte CloudEvents value.

Trace

Durable, non-generic decision trace.

TrustedServiceBinding

A separately named binding for an explicitly trusted internal service.

Enums

AuditEntryError

Validation failure for a current durable audit entry.

BindingAuthority

Authority metadata supplied by the application that verified a binding.

Condition

Boolean predicate over known or deferred facts.

ContextError

Error returned when a request context cannot establish a safe tenant boundary.

DecisionAuditOccurrenceError

Validation failure for a decision occurrence crossing the SQL audit boundary.

DecisiveClause

Typed decisive clause.

DenyShape

Disclosure shape for a denied grant.

Effect

Permit or deny effect produced by evaluation.

EffectKind

Permit/deny effect without the generic outcome value.

FactResolutionError

Invalid or stale freshness information in a resolver envelope.

FactResolutionEvidenceError

Failure while creating bounded fact-set evidence.

GatekeepError

Validation errors returned by typed gatekeep records.

LowerError

Error returned by query-lowering adapters.

Policy

Reified authorization policy.

Presence

Presence state of a named fact.

ReasonValue

Structured denial-reason parameter value.

Residual

Result of partial evaluation with possibly unknown facts.

ResidualPolicy

Residual policy produced by partial evaluation.

ResidualPolicyBranch

Child branch considered by ResidualPolicy::try_fold_pruned.

ResidualPolicyNode

Fold node exposed by ResidualPolicy::try_fold.

ResolveError

Error returned by fact resolution orchestration.

TenantBinding

The binding authority carried by a crate::Context.

TenantBindingError

Errors returned when constructing or validating a tenant binding.

TraceClause

Serialized decisive clause.

TraceError

Error produced while serializing trace or reason values.

Constants

MAX_TENANT_ID_BYTES

Maximum UTF-8 byte length shared with Dovecote tenant routing values.

POLICY_HASH_FORMAT_VERSION

Durable encoding version used by Policy::hash.

Traits

AuditSink

Append-only audit boundary.

Clock

Application-owned source of UTC instants used at adapter boundaries.

Fact

Marker trait for compile-time known facts.

FactResolver

Async boundary that resolves policy facts from application-owned storage.

Lattice

Outcome ordering used when policies combine permissions.

ObligationSpec

Marker trait for compile-time known obligations.

PolicyObserver

Side-channel observer for decision summaries.

QueryLowering

Lowers a residual policy into a backend filter and grade projection.

ReasonCatalog

Presentation adapter for localized denial reasons.

Functions

complete_residual

Completes a partial-evaluation result against known facts.

evaluate

Evaluates a policy against known facts.

evaluate_residual

Evaluates a residual policy against known facts.

partial_evaluate

Partially evaluates a policy against present, absent, and unknown facts.

required_facts

Returns every fact that may be consulted by a policy.

required_residual_facts

Returns every fact that may be consulted by a residual policy.

Type Aliases

GatekeepResult

Result type used by gatekeep constructors and validators.

TraceValue

Opaque serialized value used only for trace and audit output.