Module binding 

Identity claims are checked against the admitted Lys holder, never a seat file.

Functions

check

Identity is an additional fence; passing it grants no subject right.

claim

Checks a tool’s identity claim against the pass’s own agent identity.

decide

Decides the ordinary subject grant after the identity fence.

evaluate_subject

Maps agent message/watch to the placed agent’s right. Every other act uses

is_host_route

Closed host services always authenticate their payload claim in the handler.

refusal

Names the actual grant used by the alias, preserving the consumer’s cause.

refuse_server_publish

The server’s inner publish guard, including direct trait callers.

server_owned

Whether a subject has the server as its sole writer.

subject

The name and leaf of an exact agent subject. Patterns are never identities.