Documentation
¶
Overview ¶
Command gen-rule turns a validated capability claims file (the minimal set produced by gen-capability and consumed by `aic issue --from-claims`) into rule files for the execution layer.
Usage: gen-rule -schemes <capability-data-dir> -claims <claims.json> [flags]
For every claim it writes one rule file in the publication layout
<out>/<scheme>/v<major>.<minor>.json
with the claim's capability and parameters, plus (optionally) the conditions / constraints / flow taken from a template rule. Claims for the same scheme take ascending minor versions in file order.
Nothing is written unless the generated rule passes both gates:
- LoadRuleBytes — structure, unknown fields rejected (fail-closed, so a misspelled key cannot silently drop a constraint), and
- Rule.Validate — the capability exists in the registry and the parameters satisfy that scheme's params_schema.
The output is a skeleton: it carries authorization-relevant parameters but no runtime conditions unless a template supplies them. Rules still have to be signed and published (`go run ./demo/rule-exec -publish`), and the loader additionally enforces that the rule stays inside the SIGNER's own AIC grant.
Source Files