dataaccess

Nov 4, 2026

Changes in this version

type AccessRequest

+ Lifetime Lifetime

+ type AgentSession struct

+ EndsAt time.Time

+ ID string

type Grant

+ AgentSessionID string

+ Lifetime Lifetime

+ type Lifetime string

+ const LifetimeDeadline

+ const LifetimeOnce

+ const LifetimeSession

type Resolution

+ AgentSession *AgentSession

Nov 4, 2026

Changes in this version

+ func Covers(r Resolution, scope GrantScope) (bool, error)

type Decision

+ ByAgentUser bool

+ Dormant bool

+ ForOwnAgent bool

+ type Forwarding struct

+ At time.Time

+ By Subject

+ Note string

type Grant

+ AgentUser *Subject

+ EffectiveAt *time.Time

+ Forwarded *Forwarding

type Resolution

+ AgentUser *Resolution

+ func ProjectAgentResolution(ctx context.Context, user Resolution, agent Subject, grants []Grant, ...) (Resolution, error)

Nov 4, 2026

Changes in this version

+ type InspectedAssessment struct

+ Outcome access.AssessmentOutcome

+ Policies []InspectedPolicy

+ type InspectedPolicy struct

+ Allowed bool

+ Code access.ReasonCode

+ Policy string

+ type TableReadInspection struct

+ Admitted bool

+ Assessment InspectedAssessment

+ Code string

+ Until time.Time

+ func InspectTableRead(ctx context.Context, resolution Resolution, mandatory *ExactReadSnapshot, ...) (TableReadInspection, error)

Nov 2, 2026

Changes in this version

+ type ExactReadPolicy struct

+ Baseline []ObjectRef

+ Connection ConnectionRef

+ Subject Subject

+ Version int

+ func (p *ExactReadPolicy) UnmarshalJSON(data []byte) error

+ type ExactReadSnapshot struct

+ func DecodeExactReadSnapshot(data []byte) (*ExactReadSnapshot, error)

+ func (*ExactReadSnapshot) MarshalJSON() ([]byte, error)

+ func (ExactReadSnapshot) Format(state fmt.State, _ rune)

+ func (ExactReadSnapshot) GoString() string

+ func (ExactReadSnapshot) LogValue() slog.Value

+ func (ExactReadSnapshot) String() string

+ func (s *ExactReadSnapshot) BindContext(ctx context.Context, subject Subject) (context.Context, error)

+ func (s *ExactReadSnapshot) RequestableObjects() []ObjectRef

type ReadPosture

+ const ReadExact

type Resolution

+ ExactRead *ExactReadPolicy

+ func ProjectAgentExactRead(ctx context.Context, user Resolution, agent Subject, s *ExactReadSnapshot) (Resolution, error)

+ func ProjectExactRead(ctx context.Context, r Resolution, s *ExactReadSnapshot) (Resolution, error)

Nov 1, 2026

Changes in this version

+ const StructuredReadProfile

type Authority

+ func NewLocalAuthority(subject Subject, connection LocalConnectionRef, resolve Resolver) (*Authority, error)

+ func (a *Authority) ImportStructuredResult(ctx context.Context, request ResultRequest, started time.Time, ...) (*Result, error)

+ func (a *Authority) ReadStructuredResult(ctx context.Context, request ResultRequest, operation StructuredRead, ...) (*Result, error)

type ConnectionRef

+ LocalAuthorityID string

+ type LocalConnectionRef struct

+ AuthorityID string

+ Fingerprint Fingerprint

+ ID string

+ type StructuredIdentityFacts struct

+ Connection ConnectionRef

+ Resources []StructuredResourceIdentity

+ type StructuredIdentityRequest struct

+ Connection ConnectionRef

+ Resources []StructuredResourceIdentity

+ type StructuredRead struct

+ MaxBytes uint32

+ MaxRows uint32

+ Parameters string

+ TugQL string

+ func (op StructuredRead) RequestFor(nonce string) (ResultRequest, error)

+ type StructuredReadSource interface

+ OpenStructuredRead func(context.Context, StructuredIdentityRequest) (StructuredReadSpan, error)

+ type StructuredReadSpan interface

+ Close func() error

+ Session func() dal.ReadSession

+ Verify func(context.Context, StructuredIdentityRequest) (StructuredIdentityFacts, error)

+ type StructuredResourceIdentity struct

+ Path string

+ Table access.TableName

+ type StructuredResultEnvelope struct

+ Lease StructuredResultLease

+ Payload json.RawMessage

+ func DecodeStructuredResultEnvelope(data []byte) (StructuredResultEnvelope, error)

+ type StructuredResultLease struct

+ ExecutedTugQL string

+ ExecutionSHA256 string

+ Operation StructuredRead

+ Profile string

Oct 31, 2026

Changes in this version

+ const TableReadProfile

type Authority

+ func (a *Authority) ImportTableResult(ctx context.Context, request ResultRequest, started time.Time, ...) (*Result, error)

+ func (a *Authority) ReadTableResult(ctx context.Context, request ResultRequest, operation TableRead, ...) (*Result, error)

+ type TableRead struct

+ MaxBytes uint32

+ MaxRows uint32

+ Object ObjectRef

+ type TableReadSource interface

+ OpenTableRead func(context.Context, TableIdentityRequest) (TableReadSpan, error)

+ type TableReadSpan interface

+ Close func() error

+ Session func() dal.ReadSession

+ Verify func(context.Context, TableIdentityRequest) (TableIdentityFacts, error)

+ type TableResultEnvelope struct

+ Lease TableResultLease

+ Payload json.RawMessage

+ func DecodeTableResultEnvelope(data []byte) (TableResultEnvelope, error)

+ type TableResultLease struct

+ Operation TableRead

+ Profile string

Oct 31, 2026

Changes in this version

type Authority

+ func (a *Authority) SecureDBWithTableIdentity(db dal.DB, verifier TableIdentityVerifier) (Database, error)

+ type TableIdentityFacts struct

+ Connection ConnectionRef

+ Table access.TableName

+ type TableIdentityRequest struct

+ Connection ConnectionRef

+ Table access.TableName

+ type TableIdentityVerifier interface

+ VerifyTableIdentity func(context.Context, dal.DB, TableIdentityRequest) (TableIdentityFacts, error)

Oct 31, 2026

Changes in this version

type Authority

+ func (a *Authority) CaptureResult(ctx context.Context, request ResultRequest, ...) (*Result, error)

+ func (a *Authority) ImportResult(ctx context.Context, request ResultRequest, requestStarted time.Time, ...) (*Result, error)

+ type Result struct

+ func (r *Result) Close()

+ func (r *Result) WriteEnvelope(ctx context.Context, writer io.Writer) error

+ func (r *Result) WritePayload(ctx context.Context, writer io.Writer) error

+ type ResultEnvelope struct

+ Lease ResultLease

+ Payload json.RawMessage

+ func DecodeResultEnvelope(data []byte) (ResultEnvelope, error)

+ type ResultLease struct

+ Connection ConnectionRef

+ ExpiresAt time.Time

+ GrantSetDigest string

+ Nonce string

+ PayloadSHA256 string

+ RequestSHA256 string

+ ServerTime time.Time

+ Subject Subject

+ Version int

+ type ResultRequest struct

+ Nonce string

+ RequestSHA256 string

Oct 30, 2026

Changes in this version

+ const ObjectsExact

+ type AccessRequest struct

+ CaseRef *CaseRef

+ ExpiresAt time.Time

+ Permissions []Permission

+ PriorGrant string

+ Reason string

+ Scope GrantScope

+ func DecodeAccessRequest(data []byte) (AccessRequest, error)

+ func (r AccessRequest) ValidateMVP() error

+ type AgentRead string

+ const AgentInherit

+ const AgentNone

+ type Authority struct

+ func NewAuthority(subject Subject, connection ConnectionRef, resolve Resolver) (*Authority, error)

+ func (a *Authority) SecureDB(db dal.DB) (Database, error)

+ type CaseRef struct

+ ID string

+ Kind string

+ type ConnectionProtection struct

+ AgentRead AgentRead

+ Environment string

+ Fingerprint Fingerprint

+ ID string

+ MandatoryFineGrained bool

+ MaxDuration map[Permission]int

+ Name string

+ ReadOnly bool

+ ReadPosture ReadPosture

+ Revision int64

+ type ConnectionRef struct

+ Fingerprint Fingerprint

+ ID string

+ Space string

+ type Database interface

+ type Decision struct

+ At time.Time

+ By Subject

+ Narrowed bool

+ Note string

+ Self bool

+ type Denial struct

+ Capability Permission

+ Code string

+ Connection string

+ func (e *Denial) Error() string

+ func (e *Denial) Unwrap() error

+ type FieldScope struct

+ Exclude []string

+ Include []string

+ type Fingerprint struct

+ Address string

+ Database string

+ Engine string

+ EngineIdentity string

+ type Grant struct

+ CaseRef *CaseRef

+ Decision *Decision

+ ExpiresAt time.Time

+ ID string

+ NotBefore *time.Time

+ Permissions []Permission

+ PriorGrant string

+ Reason string

+ RequestedBy Subject

+ Revision int64

+ Scope GrantScope

+ State GrantState

+ Subject Subject

+ func DecodeGrant(data []byte) (Grant, error)

+ func (g Grant) ValidateMVP() error

+ type GrantScope struct

+ Connection string

+ Exclude []Selector

+ Fields *FieldScope

+ Objects []ObjectRef

+ Records *RecordScope

+ Request *RequestBinding

+ Requires []string

+ Schemas []Selector

+ func (s GrantScope) ValidateMVP(permissions []Permission) error

+ type GrantState string

+ const Approved

+ const Expired

+ const Refused

+ const Requested

+ const Revoked

+ const Withdrawn

+ type ObjectRef struct

+ Name string

+ Namespace string

+ type Permission string

+ const DataDelete

+ const DataInsert

+ const DataRead

+ const DataReveal

+ const DataUpdate

+ const DataWrite

+ const QueryRaw

+ const QueryTugQL

+ type ReadPosture string

+ const ReadAll

+ const ReadNone

+ type RecordScope struct

+ Language string

+ Predicate json.RawMessage

+ type RequestBinding struct

+ Fingerprint string

+ type Resolution struct

+ Connection ConnectionRef

+ Grants []Grant

+ Protection ConnectionProtection

+ ServerTime time.Time

+ Subject Subject

+ ValidUntil time.Time

+ type ResolveRequest struct

+ Connection ConnectionRef

+ Subject Subject

+ type Resolver func(context.Context, ResolveRequest) (Resolution, error)

+ type Selector struct

+ Kind string

+ Value string

+ type Subject struct

+ ID string

+ Kind SubjectKind

+ Realm string

+ func (s Subject) Validate() error

+ type SubjectKind string

+ const Agent

+ const Service

+ const User