authz-store

The durable half of the XAP authority model: the trust store itself. Opening one binds a journal and replays the authz stream to rebuild trust state, and every verb here — issuing and revoking delegations, minting guardian grants, allocating and debiting budget meters, approving and committing a proposal — records its attributed event before the in-process state moves, so the authority basis is a log rather than mutable state. Deciding on that basis is pure and is cx-stdlib/authz; this module is what a decision is a decision ABOUT.

authz-store:store

[$authz-store:store] -> element — Open an authority store — the trust-state handle for one tenant, taken by the persisting and live-read verbs.

      [?lib 'cx-stdlib/authz']
[?lib 'cx-platform/authz-store']
[?let [= $az [$authz-store:store {tenant: 'acme'}]]
  [= $d [$authz-store:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund-duplicate]] [over '/orders'] [assurance :t1] [signature sig-dana]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund-duplicate] [slice '/orders/9'] [tenant acme]]]]

      [permit rooted-principal=dana [delegation d-1] [via d-1] [tier :t1] [capability refund-duplicate]]

authz-store:close

[$authz-store:close] -> null — Close an authority store — idempotent, never raises.

      [?lib 'cx-stdlib/authz']
[?lib 'cx-platform/authz-store']
[?let [= $az [$authz-store:store {tenant: 'acme'}]]
  [= $c [$authz-store:close $az]]
  [$authz:check $az [authz-request [actor [agent x]] [capability y] [tenant acme]]]]

      cx-err:CXER4712

authz-store:delegate

[$authz-store:delegate] -> element — Issue an ordinary delegation, enforcing attenuation — conveying more than the issuer holds raises CXER4703.

      [?lib 'cx-stdlib/authz']
[?lib 'cx-platform/authz-store']
[?let [= $az [$authz-store:store {tenant: 'acme'}]]
  [= $d [$authz-store:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund-duplicate]] [over '/orders'] [assurance :t1] [signature sig-dana]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund-duplicate] [slice '/orders/9'] [tenant acme]]]]

      [permit rooted-principal=dana [delegation d-1] [via d-1] [tier :t1] [capability refund-duplicate]]

authz-store:revoke

[$authz-store:revoke] -> element — Revoke a delegation by id — idempotent; opts.cascade also revokes everything it sourced.

      [?lib 'cx-stdlib/authz']
[?lib 'cx-platform/authz-store']
[?let [= $az [$authz-store:store {tenant: 'acme'}]]
  [= $d [$authz-store:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [over '/orders'] [assurance :t1] [signature s]]]]
  [= $r [$authz-store:revoke $az 'd-1']]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund] [slice '/orders/9'] [tenant acme]]]]

      [deny actor=ops-1 [code cx-err:CXER4700] [reason :no-grant] [capability refund] [slice /orders/9] [tenant id=acme]]

authz-store:grant-guardian

[$authz-store:grant-guardian] -> element — Issue a guardian grant after the full two-validator check, storing it dormant until its incapacity gate fires.

      [?lib 'cx-stdlib/authz']
[?lib 'cx-platform/authz-store']
[?let [= $az [$authz-store:store {tenant: 'acme'}]]
  [= $g [$authz-store:grant-guardian $az
    [delegation g-1 [tenant acme] [mode :guardian] [from [principal admin]] [to [agent ops-1]]
      [capabilities [pause-gw]] [action [do :pause-gw]]
      [gate [all [incapacity [no-ack-within [of :escalation]]] [state [gt '/charge-error-rate' 0.15]]]]
      [assurance :t1] [signature sig-admin]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability pause-gw] [tenant acme]]
    {with-context: [context [no-ack-within true] [charge-error-rate 0.2]]}]]

      [permit rooted-principal=admin [delegation g-1] [via g-1] [tier :t1] [capability pause-gw]]

authz-store:meters

[$authz-store:meters] -> element — Fold the bound journal's debit events into the [meters ...] snapshot check reads ({meters: ...}) — rate as token-bucket replay, count monotone, spend inside the current UTC-Z window; opts.now pins the fold instant. Needs the journal-bound (durable) tier.

authz-store:debit

[$authz-store:debit] -> element — Charge a delegation's meters at the commit point: re-checks headroom under the journal stream's commit lock, appends the authz-debited event, and returns a [debited ...] receipt — exhausted yields the CXER4713-carrying [deny ...] value and writes nothing. Refunds never credit back.

authz-store:allocate

[$authz-store:allocate] -> element — Reserve an ESCROW ALLOCATION from a parent delegation's meter (stream 10, cross_stream_coordination §3): the reservation debits the parent chain AT ALLOCATION TIME under the parent's commit lock (an uncoverable reservation is the CXER4713 deny naming the failing conjunct — the global cap enforces here, never at a later cross-stream draw); window attribution pins at the reservation instant. Scope: count and spend ONLY — rate is a flow property (a reserved rate is unused capacity or double-counted flow) and refuses; a sub-delegation carrying rate meters it locally, un-escrowed. Allocation ids are single-use (reserve once, draw via debit {allocation: id}, expire).

      [?lib 'cx-platform/store']
[?lib 'cx-platform/journal']
[?lib 'cx-platform/authz-store']
[?let
[= $s [$store:open "mem://esc-1"]]
[= $j [$journal:attach $s "acme"]]
[= $az [$authz-store:store {tenant: "acme" journal: $j}]]
[= $d [$authz-store:delegate $az
  [delegation d-parent [tenant acme] [from [principal dana]] [to [agent team-1]]
    [capabilities [spend-money]] [bounds [count 10] [spend 100.0 :currency :USD :per '1d']] [assurance :t1] [signature s]]]]
[= $a1 [$authz-store:allocate $az "esc-1" {from: "d-parent" count: 4 spend: 40.0 currency: "USD" at: "2026-08-12T10:00:00Z"}]]
[= $rate-refused [?fallback [$authz-store:allocate $az "esc-r" {from: "d-parent" rate: {n: 5 per: "PT1M"}}] [recover-with [context] [code $err@code]]]]
[= $over [$authz-store:allocate $az "esc-2" {from: "d-parent" spend: 70.0 currency: "USD" at: "2026-08-12T10:01:00Z"}]]
[= $draw1 [$authz-store:debit $az "d-parent" {allocation: "esc-1" count: 2 spend: 15.0 currency: "USD" at: "2026-08-12T10:05:00Z"}]]
[= $draw-over [$authz-store:debit $az "d-parent" {allocation: "esc-1" count: 3 at: "2026-08-12T10:06:00Z"}]]
[= $exp [$authz-store:allocation-expire $az "esc-1" {at: "2026-08-12T11:00:00Z"}]]
[= $draw-late [$authz-store:debit $az "d-parent" {allocation: "esc-1" count: 1 at: "2026-08-12T11:05:00Z"}]]
[= $after [$authz-store:allocate $az "esc-3" {from: "d-parent" spend: 70.0 currency: "USD" at: "2026-08-12T11:10:00Z"}]]
  [probe [reserved $a1] [rate $rate-refused] [over-reserve $over] [draw $draw1] [draw-over $draw-over] [expired $exp] [draw-late $draw-late] [reclaimed-then-ok $after]]]

      [probe [reserved [allocated alloc=esc-1 from=d-parent count=4 spend=4.0e1 currency=USD]] [rate [code cx-err:CXER4711]] [over-reserve [deny [code cx-err:CXER4713] [reason :budget-exhausted] [conjunct :spend] [delegation d-parent]]] [draw [debited id=d-parent alloc=esc-1 count=2 spend=1.5e1 currency=USD]] [draw-over [deny [code cx-err:CXER4713] [reason :budget-exhausted] [conjunct :allocation-count] [delegation esc-1]]] [expired [allocation-expired alloc=esc-1 reclaimed-count=2 reclaimed-spend=2.5e1]] [draw-late [deny [code cx-err:CXER4713] [reason :budget-exhausted] [conjunct :allocation-expired] [delegation esc-1]]] [reclaimed-then-ok [allocated alloc=esc-3 from=d-parent spend=7.0e1 currency=USD]]]

authz-store:allocation-expire

[$authz-store:allocation-expire] -> element — Expire an allocation, reclaiming its UN-DRAWN remainder — visibly (reclaimed-count/reclaimed-spend) and WITHOUT replenishment: the un-drawn part never left the window's budget, so reclaiming it restores availability while spent budget stays monotone (the two rules compose). After expiry the parent's consumption for the allocation is exactly what was drawn; further draws against it deny naming :allocation-expired. Typically armed via a sched durable timer.

      [?lib 'cx-platform/store']
[?lib 'cx-platform/journal']
[?lib 'cx-platform/authz-store']
[?let
[= $s [$store:open "mem://esc-1"]]
[= $j [$journal:attach $s "acme"]]
[= $az [$authz-store:store {tenant: "acme" journal: $j}]]
[= $d [$authz-store:delegate $az
  [delegation d-parent [tenant acme] [from [principal dana]] [to [agent team-1]]
    [capabilities [spend-money]] [bounds [count 10] [spend 100.0 :currency :USD :per '1d']] [assurance :t1] [signature s]]]]
[= $a1 [$authz-store:allocate $az "esc-1" {from: "d-parent" count: 4 spend: 40.0 currency: "USD" at: "2026-08-12T10:00:00Z"}]]
[= $rate-refused [?fallback [$authz-store:allocate $az "esc-r" {from: "d-parent" rate: {n: 5 per: "PT1M"}}] [recover-with [context] [code $err@code]]]]
[= $over [$authz-store:allocate $az "esc-2" {from: "d-parent" spend: 70.0 currency: "USD" at: "2026-08-12T10:01:00Z"}]]
[= $draw1 [$authz-store:debit $az "d-parent" {allocation: "esc-1" count: 2 spend: 15.0 currency: "USD" at: "2026-08-12T10:05:00Z"}]]
[= $draw-over [$authz-store:debit $az "d-parent" {allocation: "esc-1" count: 3 at: "2026-08-12T10:06:00Z"}]]
[= $exp [$authz-store:allocation-expire $az "esc-1" {at: "2026-08-12T11:00:00Z"}]]
[= $draw-late [$authz-store:debit $az "d-parent" {allocation: "esc-1" count: 1 at: "2026-08-12T11:05:00Z"}]]
[= $after [$authz-store:allocate $az "esc-3" {from: "d-parent" spend: 70.0 currency: "USD" at: "2026-08-12T11:10:00Z"}]]
  [probe [reserved $a1] [rate $rate-refused] [over-reserve $over] [draw $draw1] [draw-over $draw-over] [expired $exp] [draw-late $draw-late] [reclaimed-then-ok $after]]]

      [probe [reserved [allocated alloc=esc-1 from=d-parent count=4 spend=4.0e1 currency=USD]] [rate [code cx-err:CXER4711]] [over-reserve [deny [code cx-err:CXER4713] [reason :budget-exhausted] [conjunct :spend] [delegation d-parent]]] [draw [debited id=d-parent alloc=esc-1 count=2 spend=1.5e1 currency=USD]] [draw-over [deny [code cx-err:CXER4713] [reason :budget-exhausted] [conjunct :allocation-count] [delegation esc-1]]] [expired [allocation-expired alloc=esc-1 reclaimed-count=2 reclaimed-spend=2.5e1]] [draw-late [deny [code cx-err:CXER4713] [reason :budget-exhausted] [conjunct :allocation-expired] [delegation esc-1]]] [reclaimed-then-ok [allocated alloc=esc-3 from=d-parent spend=7.0e1 currency=USD]]]

authz-store:approve

[$authz-store:approve] -> element — Mint the [approval ...] claim binding a proposal's Tier-1 ADDRESS (never a name or args — forgeable): opts.by names the principal, opts.tier the assurance tier, opts.signature the suite slot (mandatory; verifiers fail closed).

authz-store:commit

[$authz-store:commit] -> element — Dispose an approved proposal fail-closed: the proposal must re-hash to the approval's subject, the approval must verify per its tier, no propose-only link may ground the basis, requires cap: refs re-resolve, the presented command must match the approved def-text address, preconditions re-evaluate — then execute, debit under the commit lock, and journal the transition. Needs the journal-bound tier.