Permissions and Policy

Purpose

Policy-aware strand vault with sessions, permissions, storage backends, WAL, fsck, snapshots, and replication.

This page follows the real source shape for Strand Vault and explains the workflow a developer is likely to use first.

Trust contract

Document which keys authorize the operation, what is signed, what is encrypted, what is deliberately public, and which policy hook can deny the call. Security examples should use deterministic test vectors where possible.

Primary types to know

• AgentPermissions — libs/strand-vault/src/permissions.rs
• AppendGuard — libs/strand-vault/src/vault.rs
• Atom — libs/strand-vault/src/vault.rs
• CreateOptions — libs/strand-vault/src/config.rs
• DefaultPolicy — libs/strand-vault/src/policy.rs
• FileMetadataStorage — libs/strand-vault/src/storage/filesystem.rs
• FileSystemStorage — libs/strand-vault/src/storage/filesystem.rs
• FileSystemStorageFactory — libs/strand-vault/src/storage/filesystem.rs
• FileStrandStorage — libs/strand-vault/src/storage/filesystem.rs
• FsckReport — libs/strand-vault/src/fsck.rs
• IndexingConfig — libs/strand-vault/src/config.rs
• LruStoragePool — libs/strand-vault/src/storage/mod.rs

Example shape

use strand_vault::{AgentPermissions, Permission};

fn main() {
    // Permissions ship with two preset constructors plus a custom builder.
    let admin = AgentPermissions::full_access();
    let viewer = AgentPermissions::read_only();
    let mut writer = AgentPermissions::default();
    writer.max_strands = Some(8);
    writer.max_storage_bytes = Some(64 * 1024 * 1024);
    writer.custom.insert("woven.publish".into());

    // has_permission is the unified check used by vault-side authorization.
    assert!(admin.has_permission(Permission::Delete));
    assert!(!viewer.has_permission(Permission::Create));
    assert!(writer.has_permission(Permission::Custom("woven.publish".into())));

    println!(
        "admin_can_delete=true viewer_can_create={} writer_custom_count={}",
        viewer.can_create,
        writer.custom.len(),
    );
}