authz

type AllowAllAuthorizer struct{}

type AuthorizationInput struct {
	// Subject is the authenticated identity resolved from trusted host context.
	Subject Subject

	// CapabilityID is the capability's stable policy identity.
	CapabilityID string

	// CapabilityName is the model-facing dotted capability name.
	CapabilityName string

	// Arguments is a fresh canonical JSON-shaped projection of validated arguments.
	Arguments map[string]any
}

type Authorizer interface {
	// Authorize returns nil to allow the invocation, an error wrapping ErrDenied for a recognized denial,
	// or another error when policy evaluation fails.
	Authorize(context.Context, AuthorizationInput) error
}

type Subject struct {
	// ID is the caller's stable, non-secret identity.
	ID SubjectID
}

type SubjectID string