khive_gate/lib.rs
1//! Pluggable authorization gate for verb dispatch.
2//!
3//! The runtime consults a [`Gate`] impl before dispatching each verb. The default
4//! [`AllowAllGate`] is permissive. For production enforcement, plug a Rego-backed
5//! or capability-witness-backed impl into `RuntimeConfig.gate`.
6//! Wire types validate invariants at construction and deserialization boundaries.
7
8mod actor;
9mod audit;
10mod context;
11mod decision;
12mod error;
13mod gate;
14mod obligation;
15mod request;
16
17pub use actor::ActorRef;
18pub use audit::{AuditDecision, AuditEvent};
19pub use context::GateContext;
20pub use decision::GateDecision;
21pub use error::{GateError, GateValidationError};
22pub use gate::{AllowAllGate, Gate, GateRef};
23pub use obligation::Obligation;
24pub use request::GateRequest;
25
26#[cfg(test)]
27mod tests;