Struct AuthzRequest 

pub struct AuthzRequest {

    pub entity: EntityRef,
    pub user_id: UserId,
    pub actor: Option<Actor>,
    pub client_id: Option<ClientId>,
    pub access_scope: Option<AccessScope>,
    pub roles: Vec<String>,
    pub attributes: BTreeMap<String, Value>,
    pub trace_id: TraceId,
    pub session_id: Option<SessionId>,
    pub context: AuthzContext,
    pub context_id: Option<ContextId>,
    pub task_id: Option<TaskId>,
    pub act_chain: Vec<Actor>,
}

One authorization question, as sent to the configured hook.

This struct crosses the wire as JSON to an out-of-process hook, so every field added after user_id is optional on the wire: a hook built against an older shape must still parse a newer request, or every governed call would fail closed while the two sides are deployed separately.

actor is the surface the request came through (user, mcp server, agent, job); its user_id MUST equal the top-level user_id. Build through AuthzRequest::for_actor so the two cannot diverge. client_id is the OAuth client from the validated token, never from a request header.

Fields

entity: EntityRef

user_id: UserId

actor: Option<Actor>

client_id: Option<ClientId>

access_scope: Option<AccessScope>

roles: Vec<String>

attributes: BTreeMap<String, Value>

trace_id: TraceId

session_id: Option<SessionId>

context: AuthzContext

context_id: Option<ContextId>

task_id: Option<TaskId>

act_chain: Vec<Actor>

Implementations

impl AuthzRequest

pub fn for_actor(self, actor: Actor) -> Self

pub fn actor(&self) -> Actor

pub fn verified_agent_id(&self) -> Option<&str>

Trait Implementations

impl Clone for AuthzRequest

fn clone(&self) -> AuthzRequest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthzRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthzRequest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthzRequest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.