Expand description
Client for an external AuthZEN policy decision point (Authorization API 1.0).
When [authzen] is configured, every tool call that the local policy
decision point permits is also sent to the external PDP’s Access
Evaluation endpoint (POST .../access/v1/evaluation). Both must permit.
The request names the human principal as the subject, the acting agent
and its scopes as subject properties, the resolved business intent as
the action, and the tool (with its backend) as the resource.
A {"decision": false} answer is an audited policy denial
(PDP_DENIED). Anything else that is not a well-formed decision — a
timeout, a connection failure, a non-200 status, an unreadable body —
fails closed with 503, because an unreachable policy service is an
availability fault, not a verdict about the caller.
Structs§
- Authzen
Client - HTTP client for the configured AuthZEN endpoints.
Enums§
- Authzen
Decision - The external PDP’s verdict.
Functions§
- decision_
of - Read
{"decision": bool, "context": ...}; anything else is an error.