Skip to main content

Module scope

Module scope 

Source
Expand description

Canonical scope vocabulary for Ratify Protocol v1.

MUST stay in lock-step with Go’s scope.go, TS’s scope.ts, and Python’s scope.py.

Constants§

CUSTOM_SCOPE_PREFIX
Any scope string starting with CUSTOM_SCOPE_PREFIX is accepted by validate_scopes, passes through expand_scopes unchanged, and is treated as non-sensitive unless the application opts in via out-of-band policy.
SCOPE_ACTUATE_MOTOR
SCOPE_ACTUATE_SWITCH
SCOPE_ACTUATE_VALVE
SCOPE_COMMS_CALENDAR_READ
SCOPE_COMMS_CALENDAR_WRITE
SCOPE_COMMS_EMAIL_DELETE
SCOPE_COMMS_EMAIL_READ
SCOPE_COMMS_EMAIL_SEND
SCOPE_COMMS_MESSAGE_DELETE
SCOPE_COMMS_MESSAGE_READ
SCOPE_COMMS_MESSAGE_SEND
SCOPE_CONTRACT_READ
SCOPE_CONTRACT_SIGN
SCOPE_DATA_DELETE
SCOPE_DATA_EXPORT
SCOPE_DATA_READ
SCOPE_DATA_SHARE
SCOPE_DATA_WRITE
SCOPE_DRONE_CAPTURE
SCOPE_DRONE_DELIVER
SCOPE_DRONE_FLY
SCOPE_EXECUTE_CODE
SCOPE_EXECUTE_TOOL
SCOPE_FILES_READ
SCOPE_FILES_WRITE
SCOPE_GENERATE_CONTENT
SCOPE_GENERATE_DEEPFAKE
SCOPE_IDENTITY_DELEGATE
SCOPE_IDENTITY_PROVE
SCOPE_INFRASTRUCTURE_ACCESS
SCOPE_INFRASTRUCTURE_CONTROL
SCOPE_INFRASTRUCTURE_MONITOR
SCOPE_MEETING_ATTEND
SCOPE_MEETING_CHAT
SCOPE_MEETING_RECORD
SCOPE_MEETING_SHARE_SCREEN
SCOPE_MEETING_SPEAK
SCOPE_MEETING_VIDEO
SCOPE_PAYMENTS_AUTHORIZE
SCOPE_PAYMENTS_RECEIVE
SCOPE_PAYMENTS_SEND
SCOPE_PHYSICAL_ACTUATE
SCOPE_PHYSICAL_ENTER
SCOPE_PHYSICAL_EXIT
SCOPE_PHYSICAL_MANIPULATE
SCOPE_ROBOT_INTERACT
SCOPE_ROBOT_MOVE
SCOPE_ROBOT_OPERATE
SCOPE_TRANSACT_PURCHASE
SCOPE_TRANSACT_SELL
SCOPE_VEHICLE_CHARGE
SCOPE_VEHICLE_OPERATE
SCOPE_VEHICLE_TRANSPORT

Functions§

expand_scopes
Replace wildcard scopes with their constituent non-sensitive scopes. Deduplicates and returns lex-sorted. Custom scopes pass through unchanged.
has_scope
intersect_scopes
Set of scopes in every input list after wildcard expansion. Lex-sorted.
is_sensitive
True if the scope is flagged as sensitive. Custom scopes are non-sensitive by default; applications may enforce policy out-of-band.
validate_scopes
Return an error message if any scope is invalid; None if all valid. Custom scopes (prefix “custom:”) are accepted as valid extensions.