Permissions and Policy

Local permission records

AgentPermissions records create/delete/authorize booleans, optional Strand/storage limits, namespace restrictions and custom string permissions. has_permission evaluates the four Permission variants against those fields. These are local values; they are not signed capabilities.

use strand_vault::{AgentPermissions, Permission};

let viewer = AgentPermissions::read_only();
assert!(!viewer.has_permission(Permission::Create));
let mut writer = AgentPermissions::default();
writer.custom.insert("application.publish".into());
assert!(writer.has_permission(Permission::Custom("application.publish".into())));

AccessPolicy supplies read/write/delete/authorization decisions. DefaultPolicy permits some writes without an agent namespace; WriterOnlyPolicy, OrgScopedPolicy and ReadOnlyMirrorPolicy express narrower rules. A policy type being present does not mean every public vault method invokes every hook. In particular, the organization check inside authorize_agent is currently a permissive stub.

Checkout is a concurrency handle

checkout(agent, id, SessionMode::WriteExclusive) checks the current write policy and obtains a per-Strand semaphore permit. A read checkout creates a read handle. SessionHandle contains the mode/key/permit; it does not carry an AgentPermissions snapshot or expiry. Releasing the handle releases its write permit. Enforce identity, revocation and session lifetime in the calling service.

Source reference

Exact declarations and source provenance · Package features and manifest.