Crate policy 

Who may invoke which action.

Authority is granted over the published tree of workspaces, apps, resources, items and actions. A Grant names a Subject, a node (TreePath), the kinds of action it covers (KindSet), an Answer and a Lifetime. decide is the one function every door, host and receiver uses: the most specific covering node wins, at the same node Deny beats Ask beats Allow, and no grant means Deny. Someone acting for a person (an agent, a task, a Shortcut, an app) is bounded by both: Authority::decide takes the minimum.

Roles are presets of grants on a workspace (roles); membership, roles and grants change only through the workspace’s governance actions (WorkspacePolicy). describe() renders a grant set by node, for a log; sentences() says it the way a person reads it, one sentence per grant. agent_answers are the Allow, Ask first and Deny a person sets for one of their agents, per application, kind of resource or action. authorship makes the code between a person and an action (a tilolang program) one more bounding party.

Modules

agent_answers

What a person has told one of their agents, or the work on an issue, it may do: allowed, asks first, or not allowed, for each kind of action, scoped to an application, one kind of resource in it, or one action.

authorship

Code authorship: the code between a person and an action, as one more party bounding them.

bot

A bot’s grants: the rules its program needs, held to the workspace it was installed in, never reaching governance.

describe

Grant sets in plain language, for the people who give them and the agents that hold them.

earlier

The ids apps were published under before (app so.tilo.lang.tasks "Tasks" (previously: so.tilo.lang.todo)): the one lookup every place that keeps an app id reads through.

edits

When a generic field edit asks for confirmation.

roles

Presets: named grant sets. Roles are the built-in presets on a workspace; an agent’s default delegation and the foreign-device bound are presets too.

share

Sharing one resource with a workspace: the grants a share is.

turn

A turn: the person’s message an agent acts for.

Structs

Asker

Who an invocation is admitted for, as admission weighs an ask.

Authority

Who is acting: a person, and the delegations bounding them (an agent, a task, a Shortcut, an app, a foreign device).

Bound

A delegation bounding a person: its subject and the grants it carries itself (an agent delegation’s, a Shortcut’s). The workspace’s own grants naming the subject count too.

Context

What liveness depends on where a decision is made.

Decision

One party’s answer for one node and kind.

EarlierIds

For each app, the ids it was published under before.

Grant

GrantId

Names one grant, so it can be revoked or consumed.

Ids

Labels nodes by their ids.

Invoked

What the invocation is, as admission weighs it.

KindSet

The kinds a grant covers. Serialised as the list of kinds.

Party

One source of authority: the subjects someone is known by, the grants that may name them, and the workspaces they own.

PathError

A path that does not parse.

Preset

A named grant set people pick instead of writing grants one by one.

Reach

How far an invocation was admitted to reach: the kind of action it is, and whether it exercises authority over the workspace or others in it.

Rule

One rule of a preset: a grant without its subject.

Specificity

How specific a grant’s node is. Greater is more specific: names beat open levels position by position, and a deeper node beats its ancestors.

Standing

Who is acting in a workspace and everything their authority depends on.

TreePath

A node, or a pattern of nodes, in the published tree.

Verdict

The combined answer for one node and kind, with each party’s part.

WorkspacePolicy

Everything that decides authority in one workspace.

Enums

ActionKind

What an action is able to do, derived by the framework from the action’s code and never declared by an app.

Admission

How an invocation is admitted.

Answer

The answer a grant gives. Ordered Deny < Ask < Allow, so the stricter of two answers is their minimum.

Basis

Why a party answered as it did.

Change

A change to a workspace’s authority. Each is one governance action.

Level

The level of a segment in the tree.

Lifetime

How long a grant is live.

PresetError

A preset that cannot be assigned.

Refusal

Why a governance action was refused.

Refused

Why an invocation is refused: whose answer refused it.

Role

A role preset. A member of a workspace holds one; the workspace keeps the grants each role carries (see crate::roles).

Segment

Subject

Traits

Labels

Names for nodes. The default uses ids; a host that knows app and resource names supplies them.

Functions

admit

Admit invoked for asker.

decide

Decides for one set of subjects over one set of grants:

describe

One sentence per node: Mail: reading and undoable changes allowed, outside effects ask first. Nodes come in tree order; grants with a lifetime other than until-revoked say so.

describe_node

A node as people read it: Mail › every resource › Send.

member_record

The person whose own record record is, and its kind; None for any other record.

member_record_id

The id of person’s own record of kind; person is the lowercase hex of their user root key.

sentences

One sentence per grant, in the words of the person who gave it: where it applies, then what it answers for the kinds of action it covers.