authz

The XAP authority model as data plus a single decision function. It represents principals, capabilities, attenuating/time-bounded/revocable delegations, and guardian grants gated behind incapacity-typed predicates, then decides authority at one point of enforcement: check/authorize answers whether an actor holds a capability over a slice in a tenant at the required assurance tier, returning a [permit] or [deny] value. Authority originates only from principals and can only attenuate down a delegation chain, so privilege escalation is structurally impossible. This is delegated authority — who authorized whom to do what — distinct from and AND-composed with the effect-permission capability system.

authz:store

[$authz:store] -> element — Open an authority store — the trust-state handle for one tenant, taken by the persisting and live-read verbs.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund-duplicate]] [over '/orders'] [assurance :t1] [signature sig-dana]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund-duplicate] [slice '/orders/9'] [tenant acme]]]]
          
            [permit rooted-principal=dana [delegation 'd-1'] [via 'd-1'] [tier :t1] [capability 'refund-duplicate']]

authz:close

[$authz:close] -> null — Close an authority store — idempotent, never raises.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $c [$authz:close $az]]
  [$authz:check $az [authz-request [actor [agent x]] [capability y] [tenant acme]]]]
          
            cx-err:CXER4712

authz:delegate

[$authz:delegate] -> element — Issue an ordinary delegation, enforcing attenuation — conveying more than the issuer holds raises CXER4703.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund-duplicate]] [over '/orders'] [assurance :t1] [signature sig-dana]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund-duplicate] [slice '/orders/9'] [tenant acme]]]]
          
            [permit rooted-principal=dana [delegation 'd-1'] [via 'd-1'] [tier :t1] [capability 'refund-duplicate']]

authz:revoke

[$authz:revoke] -> element — Revoke a delegation by id — idempotent; opts.cascade also revokes everything it sourced.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [over '/orders'] [assurance :t1] [signature s]]]]
  [= $r [$authz:revoke $az 'd-1']]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund] [slice '/orders/9'] [tenant acme]]]]
          
            [deny actor=ops-1 [code 'cx-err:CXER4700'] [reason :no-grant] [capability 'refund'] [slice '/orders/9'] [tenant id=acme]]

authz:grant-guardian

[$authz:grant-guardian] -> element — Issue a guardian grant after the full two-validator check, storing it dormant until its incapacity gate fires.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $g [$authz:grant-guardian $az
    [delegation g-1 [tenant acme] [mode :guardian] [from [principal admin]] [to [agent ops-1]]
      [capabilities [pause-gw]] [action [do :pause-gw]]
      [gate [all [incapacity [no-ack-within [of :escalation]]] [state [gt '/charge-error-rate' 0.15]]]]
      [assurance :t1] [signature sig-admin]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability pause-gw] [tenant acme]]
    {with-context: [context [no-ack-within true] [charge-error-rate 0.2]]}]]
          
            [permit rooted-principal=admin [delegation 'g-1'] [via 'g-1'] [tier :t1] [capability 'pause-gw']]

authz:check

[$authz:check] -> element — Decide an authorization request at the single PEP, returning a [permit] or [deny] value — always total.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund-duplicate]] [over '/orders'] [assurance :t1] [signature sig-dana]]]]
  [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund-duplicate] [slice '/orders/9'] [tenant acme]]]]
          
            [permit rooted-principal=dana [delegation 'd-1'] [via 'd-1'] [tier :t1] [capability 'refund-duplicate']]

authz:authorize

[$authz:authorize] -> element — The strict alias of check — with raise-on-deny=true a [deny] becomes a raised CXER4700.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [$authz:authorize $az [authz-request [actor [agent x]] [capability y] [tenant acme]] {raise-on-deny: true}]]
          
            cx-err:CXER4700

authz:find

[$authz:find] -> element — Look up a delegation by id — never-issued, revoked, or expired yields the absence channel.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [assurance :t1] [signature s]]]]
  [$authz:find $az 'd-1']]
          
            [delegation id=d-1 mode=delegated state=active [tenant id=acme] [to [agent id=ops-1]] [from [principal id=dana]] [capabilities [refund]] [assurance :t1]]

authz:grants-of

[$authz:grants-of] -> [sequence element] — List all currently-active delegations granted to an actor, in receive order.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [assurance :t1] [signature s]]]]
  [$authz:grants-of $az [agent ops-1]]]
          
            ([delegation id=d-1 mode=delegated state=active [tenant id=acme] [to [agent id=ops-1]] [from [principal id=dana]] [capabilities [refund]] [assurance :t1]])

authz:predicate

[$authz:predicate] -> element — Look up a signed-library incapacity predicate by name@version — unknown yields the absence channel.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [$authz:predicate $az 'no-ack-within@v1']]
          
            [predicate name=no-ack-within version=v1 [params [duration] [of]] [rationale 'a request was issued and no acknowledgement arrived within the window — truth depends on the elapsed clock + the absence of an ack event, never on the principal willing it; an ack the instant it arrives makes it false'] [signature 'bundled-library:no-ack-within@v1']]

authz:predicates

[$authz:predicates] -> [sequence element] — List the whole signed incapacity-predicate library.

authz:gate-wellformed

[$authz:gate-wellformed] -> element — Run the structural and semantic validators over a [gate …] without issuing, returning a [valid] or [invalid …] value.

            [?lib 'cx-stdlib/authz']
[$authz:gate-wellformed [gate [all [incapacity [no-ack-within]] [state [gt '/x' 1]]]]]
          
            [valid]

authz:verify-tier

[$authz:verify-tier] -> element — Verify a grant's assurance tier via crypto — returns [verified …] or raises CXER4704.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [$authz:verify-tier $az
    [delegation d [tenant acme] [from [principal dana]] [to [agent o]]
      [capabilities [x]] [assurance :t1] [signature sig-ok]] 't1']]
          
            [verified [tier :t1]]

authz:effective

[$authz:effective] -> element — Compute an actor's effective envelope — the most-restrictive intersection of individual and superior/managing/collective gates.

authz:dry-run

[$authz:dry-run] -> element — Run check over an explicit scenario with no journal write, returning the same [permit] or [deny] value.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d [tenant acme] [from [principal dana]] [to [agent o]]
      [capabilities [x]] [over '/s'] [assurance :t1] [signature s]]]]
  [$authz:dry-run $az [authz-request [actor [agent o]] [capability x] [slice '/s/1'] [tenant acme]]]]
          
            [permit rooted-principal=dana [delegation 'd'] [via 'd'] [tier :t1] [capability 'x']]

authz:explain

[$authz:explain] -> element — Turn a permit or deny into a readable [explanation …] — the authority chain or the first failing link.

            [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:store {tenant: 'acme'}]]
  [= $d [$authz:delegate $az
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [over '/orders'] [assurance :t1] [signature s]]]]
  [= $dec [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund] [slice '/orders/9'] [tenant acme]]]]
  [$authz:explain $dec]]
          
            [explanation outcome=permit [accountable 'dana'] [authority-chain [step 'd-1']]]

authz:trace

[$authz:trace] -> [sequence element] — Return the ordered policy-stack evaluation behind a decision — the deep-debug view behind explain.