optionsv1

type AuthorizationRule struct {

	// Authentication mode: "bearer", "sandbox", "dual", "peer", "operator",
	// or "unauthenticated". Operator requires a verified mTLS operator certificate.
	AuthMode string `protobuf:"bytes,1,opt,name=auth_mode,json=authMode,proto3" json:"auth_mode,omitempty"`
	// Minimum workspace-level role required (checked by handler via
	// authorize_workspace): "user" or "admin". Mutually exclusive with
	// global_role.
	WorkspaceRole string `protobuf:"bytes,2,opt,name=workspace_role,json=workspaceRole,proto3" json:"workspace_role,omitempty"`
	// Global role required (checked by middleware via OIDC claims):
	// "platform_admin". Mutually exclusive with workspace_role.
	GlobalRole string `protobuf:"bytes,3,opt,name=global_role,json=globalRole,proto3" json:"global_role,omitempty"`
	// Required OIDC scope on the bearer path (e.g. "sandbox:read").
	Scope string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"`
	// contains filtered or unexported fields
}