Skip to main content

systemprompt_security/authz/
mod.rs

1//! Unified authorization decision plane.
2//!
3//! Houses the deny-overrides resolver, `access_control_rules` repository,
4//! and [`AuthzDecisionHook`] extension surface shared by the gateway
5//! `/v1/messages` proxy and the MCP RBAC middleware. Both call
6//! [`resolve`] with different `entity_type` / `entity_id` pairs against
7//! the same table and audit shape.
8
9pub mod audit;
10pub mod config;
11pub mod error;
12pub mod extension;
13pub mod hook;
14pub mod ingestion;
15pub mod repository;
16pub mod resolver;
17pub mod runtime;
18pub mod types;
19
20pub use audit::{
21    AuthzAuditSink, AuthzSource, DbAuditSink, GovernanceDecisionRecord,
22    GovernanceDecisionRepository, NullAuditSink, insert_governance_decision,
23};
24pub use config::{AccessControlConfig, DepartmentEntry, RuleEntry};
25pub use error::{AuthzBootstrapError, AuthzError, AuthzResult};
26pub use extension::AuthzExtension;
27pub use hook::{AllowAllHook, AuthzDecisionHook, DenyAllHook, WebhookHook};
28pub use ingestion::{AccessControlIngestionService, IngestOptions, IngestReport};
29pub use repository::{AccessControlRepository, UpsertRuleParams};
30pub use resolver::resolve;
31pub use runtime::{
32    clear_global_hook, global_hook, install_from_governance_config, install_global_hook,
33};
34pub use types::{Access, AccessRule, AuthzDecision, AuthzRequest, Decision, EntityKind, RuleType};