authz

The XAP authority model as data plus a single decision function. It represents principals, capabilities, attenuating/time-bounded/revocable delegations, and guardian grants gated behind incapacity-typed predicates, then decides authority at one point of enforcement: check/authorize answers whether an actor holds a capability over a slice in a tenant at the required assurance tier, returning a [permit] or [deny] value. Authority originates only from principals and can only attenuate down a delegation chain, so privilege escalation is structurally impossible. This is delegated authority — who authorized whom to do what — distinct from and AND-composed with the effect-permission capability system. Issuing, revoking and metering that authority is durable and is cx-platform/authz-store's; deciding on it is pure and is here, and so is opening the in-memory store a decision is made against — open takes its basis as data, which is what keeps a decision program free of the durable tier.

authz:open

[$authz:open] -> element — Open an IN-MEMORY authority store for one tenant, seeded from the basis given as data — the pure constructor a program that only decides uses; the journaled one is [$authz-store:store].

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme', grants: (
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [over '/orders'] [assurance :t1] [signature s]],
    [delegation d-2 [tenant acme] [from [principal dana]] [to [agent ops-2]]
      [capabilities [read-order]] [over '/orders'] [assurance :t1] [signature s]]), revoked: 'd-2'}]]
  [probe [live [$name [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund] [slice '/orders/9'] [tenant acme]]]]]
         [revoked [$name [$authz:check $az [authz-request [actor [agent ops-2]] [capability read-order] [slice '/orders/9'] [tenant acme]]]]]]]

      [probe [live permit] [revoked deny]]

authz:check

[$authz:check] -> element — Decide an authorization request at the single PEP, returning a [permit] or [deny] value — always total.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme'}]]
  [$authz:check $az [authz-request [actor [agent ghost]] [capability refund-duplicate] [slice '/orders/9'] [tenant acme]]]]

      [deny actor=ghost [code cx-err:CXER4700] [reason :no-grant] [capability refund-duplicate] [slice /orders/9] [tenant id=acme]]

authz:authorize

[$authz:authorize] -> element — The strict alias of check — with raise-on-deny=true a [deny] becomes a raised CXER4700.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme'}]]
  [$authz:authorize $az [authz-request [actor [agent x]] [capability y] [tenant acme]] {raise-on-deny: true}]]

      cx-err:CXER4700

authz:find

[$authz:find] -> element — Look up a delegation by id — never-issued, revoked, or expired yields the absence channel.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme', grants:
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [assurance :t1] [signature s]]}]]
  [$authz:find $az 'd-1']]

      [delegation id=d-1 mode=delegated state=active [tenant id=acme] [to [agent id=ops-1]] [from [principal id=dana]] [capabilities [refund]] [assurance :t1]]

authz:grants-of

[$authz:grants-of] -> [sequence element] — List all currently-active delegations granted to an actor, in receive order.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme', grants:
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [assurance :t1] [signature s]]}]]
  [$authz:grants-of $az [agent ops-1]]]

      ([delegation id=d-1 mode=delegated state=active [tenant id=acme] [to [agent id=ops-1]] [from [principal id=dana]] [capabilities [refund]] [assurance :t1]])

authz:predicate

[$authz:predicate] -> element — Look up a signed-library incapacity predicate by name@version — unknown yields the absence channel.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme'}]]
  [$authz:predicate $az 'no-ack-within@v1']]

      [predicate name=no-ack-within version=v1 [params [duration] [of]] [rationale 'a request was issued and no acknowledgement arrived within the window — truth depends on the elapsed clock + the absence of an ack event, never on the principal willing it; an ack the instant it arrives makes it false'] [signature bundled-library:no-ack-within@v1]]

authz:predicates

[$authz:predicates] -> [sequence element] — List the whole signed incapacity-predicate library.

authz:gate-wellformed

[$authz:gate-wellformed] -> element — Run the structural and semantic validators over a [gate …] without issuing, returning a [valid] or [invalid …] value.

      [?lib 'cx-stdlib/authz']
[$authz:gate-wellformed [gate [all [incapacity [no-ack-within]] [state [gt '/x' 1]]]]]

      [valid]

authz:verify-tier

[$authz:verify-tier] -> element — Verify a grant's assurance tier via crypto — returns [verified …] or raises CXER4704.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme'}]]
  [$authz:verify-tier $az
    [delegation d [tenant acme] [from [principal dana]] [to [agent o]]
      [capabilities [x]] [assurance :t1] [signature sig-ok]] 't1']]

      [deny actor=o [code cx-err:CXER4700] [reason :tier-unmet] [capability x] [tenant id=acme]]

authz:effective

[$authz:effective] -> element — Compute an actor's effective envelope — the most-restrictive intersection of individual and superior/managing/collective gates.

authz:dry-run

[$authz:dry-run] -> element — Run check over an explicit scenario with no journal write, returning the same [permit] or [deny] value.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme', grants:
    [delegation d [tenant acme] [from [principal dana]] [to [agent o]]
      [capabilities [x]] [over '/s'] [assurance :t1] [signature s]]}]]
  [$authz:dry-run $az [authz-request [actor [agent o]] [capability x] [slice '/s/1'] [tenant acme]]]]

      [permit rooted-principal=dana [delegation d] [via d] [tier :t1] [capability x]]

authz:explain

[$authz:explain] -> element — Turn a permit or deny into a readable [explanation …] — the authority chain or the first failing link.

      [?lib 'cx-stdlib/authz']
[?let [= $az [$authz:open {tenant: 'acme', grants:
    [delegation d-1 [tenant acme] [from [principal dana]] [to [agent ops-1]]
      [capabilities [refund]] [over '/orders'] [assurance :t1] [signature s]]}]]
  [= $dec [$authz:check $az [authz-request [actor [agent ops-1]] [capability refund] [slice '/orders/9'] [tenant acme]]]]
  [$authz:explain $dec]]

      [explanation outcome=permit [accountable dana] [authority-chain [step d-1]]]

authz:trace

[$authz:trace] -> [sequence element] — Return the ordered policy-stack evaluation behind a decision — the deep-debug view behind explain.

authz:resolve-cap

[$authz:resolve-cap] -> element — Resolve a cap:sha2-256 authority-artifact address against the LIVE registry view — the artifact must exist, be un-revoked, and un-expired; anything else is the fail-closed CXER4716 (a trust input that cannot be proven live is refused).