authcontract

Overview ¶

Package authcontract is the shared conformance suite for the auth.Authorizer port (ADR-0018): Run asserts the default-deny namespace-RBAC guarantee against any driver — admin spans namespaces + cluster-scoped kinds, developer writes only in its namespaces, viewer is read-only and never reads a Secret, and an unknown principal is denied. The built-in rbac driver runs it; the cedar-go V2 driver will inherit it.