perm

type Check struct {
	DocType string
	Action  string
	DocID   string // empty when not operating on a specific record
	Data    map[string]any
}

type Engine interface {
	// CheckAction evaluates document-level CRUD permission for the caller
	// in ctx. Returns errors.CodePermission if denied.
	CheckAction(ctx context.Context, docType, action string) error

	// CheckRoles enforces a role-list gate for registry-less (synthetic)
	// DocTypes such as "method:<name>" for custom RPC methods (TAD §9.2) and
	// workflow transitions (TAD §8.1 step 3), which have no CompiledDoc to
	// derive permissions from. Union-of-roles semantics: ANY listed role
	// grants; "System Administrator" always grants; "*" matches any
	// authenticated identity; an empty list grants (public), mirroring
	// CheckAction's allow-when-no-Permissions behavior. Denial is logged per
	// TAD §13.3 and returns errors.CodePermission.
	CheckRoles(ctx context.Context, docType, action string, roles []string) error

	// FilterRead returns a copy of data containing only the fields the caller
	// is allowed to read, based on field-level oj:"permission=role" tags.
	FilterRead(ctx context.Context, docType string, data map[string]any) (map[string]any, error)

	// FilterWrite strips or rejects fields the caller is not permitted to write.
	// Returns errors.CodePermission if a gated field is present in data and the
	// caller lacks the required role (not silent dropping — active rejection).
	FilterWrite(ctx context.Context, docType string, data map[string]any) (map[string]any, error)

	// AllowedFields projects field-level permission without a data payload.
	// Used by ToolRegistry.ForIdentity (Phase 7) to build per-identity schemas.
	AllowedFields(ctx context.Context, docType, action string) ([]string, error)

	// RegisterRule wires a custom ABAC Rule into evaluation, run after RBAC.
	RegisterRule(r Rule)

	// SetDatabase attaches a database instance for dynamic RolePermission queries.
	SetDatabase(db dal.Database)
}

type Rule interface {
	Evaluate(ctx context.Context, check Check) error
}