Struct Authorizer 

pub struct Authorizer { /* private fields */ }

Capability-based authorizer.

Maintains:

• Direct grants: subject → CapabilitySet
• Roles: role name → CapabilitySet
• Role bindings: agent → list of role names

Evaluation order: direct grants → role inheritance → default policy.

Implementations

impl Authorizer

pub fn new(audit: Arc<AuditLog>) -> Self

Create a new authorizer with deny-by-default policy.

pub fn new_permissive(audit: Arc<AuditLog>) -> Self

Create a permissive authorizer (allow all by default).

pub fn grant(&self, subject: CapabilitySubject, caps: CapabilitySet)

Grant a full capability set to a subject.

pub fn grant_one(&self, subject: CapabilitySubject, cap: Capability)

Grant a single capability to a subject.

pub fn revoke(&self, subject: &CapabilitySubject)

Revoke all capabilities from a subject.

pub fn define_role(&self, role_name: &str, caps: CapabilitySet)

Define a named role with a capability set.

pub fn bind_role(&self, agent_id: &str, role_name: &str)

Bind a role to an agent.

pub fn unbind_role(&self, agent_id: &str, role_name: &str)

Remove a role binding from an agent.

pub fn check(&self, subject: &CapabilitySubject, required: &Capability) -> bool

Check if a subject has a required capability.

pub fn require( &self, subject: &CapabilitySubject, required: &Capability, ) -> Result<(), SdkError>

Require a capability, returning an error if not granted.

Trait Implementations

impl Debug for Authorizer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.