Module roles 

Presets: named grant sets. Roles are the built-in presets on a workspace; an agent’s default delegation and the foreign-device bound are presets too.

Modules

agent_policy

What an agent is in a workspace, decided in one place.

governance

The workspace’s governance actions.

Structs

Preset

A named grant set people pick instead of writing grants one by one.

Rule

One rule of a preset: a grant without its subject.

Enums

PresetError

A preset that cannot be assigned.

Constants

COMMENTS_FIELD

The field holding comments, wherever a model keeps them. The Commenter preset covers it at any depth, so field edits and verbs published on it are what a commenter may do.

DEVICE_PANEL

The app a person’s device shows the session’s own state in: quick settings, which is a panel of the session’s rather than an app of its own.

DEVICE_PANEL_GRANT

The id of the grant device_panel makes.

GOVERNANCE_KIND

The kind of every governance action. Changing who may do what reaches beyond the document — it decides what other people see and do — so an agent’s default asks before it, and the wire never lets one through on an answer that would need asking.

MODERATION_FIELD

The field node every app’s moderation actions sit under (acting on other people’s content: removing their message, locking a channel). One rule on it covers every app’s moderation, so presets need no list of verbs.

MODERATOR_GOVERNANCE

The governance a Moderator may exercise: the membership actions and restrictions, on members ranked below Moderator, and stopping or restarting a bot, so a misbehaving bot can be halted without the authority to widen it.

REACTIONS_FIELD

The field holding reactions, wherever a model keeps them (tilo_resource::Reactions). Reacting is commenting’s smallest form, so the Commenter preset covers it at any depth too.

ROOM_KIND

The kind id of the workspace’s own resource. Its actions are the workspace’s governance: membership, roles, grants and settings.

SESSION_APP

The app a person’s desktop session publishes its own functions as (the shell’s actions: windows, workspaces, its settings), on their device.

SESSION_APP_GRANT

The id of the grant session_app makes.

SESSION_KIND

The kind the session publishes its own resources under: the compositor’s state, the clipboard, the lock.

Functions

administrator_grant

The grant that makes person an administrator of workspace, given by its owner granted_by: every governance action allowed, on governance_actions.

administrator_grant_id

The id of the grant that makes person an administrator of a workspace.

administrator_moderation_grant

The grant that lets person, an administrator of workspace, moderate it: every moderation action allowed, as a Moderator may, given beside administrator_grant by its giver. It sits one level below moderation, where an Editor’s own role denies, so it decides every moderation action whatever that role says.

administrator_moderation_grant_id

The id of the grant that lets an administrator moderate person’s workspace.

agent_default

An agent’s default delegation within the scope a person gives it: Read and Undoable allowed, Outside asks.

agent_turn

The authority an agent’s turn carries in workspace: the preset of agent_policy::ROLE_CAP, narrowed by the bound the agent’s record keeps (bound; empty follows the default, which is the cap’s own). The agent acts with its person’s grants bounded by them, so it changes what its person may change, never more than the cap allows, never more than its record bounds it to, and never the workspace’s governance.

app_authorship

The grant making application app an author of its own records in workspace: it reads and changes what it keeps there as the person using it, and reaches nothing outside it. Another app’s actions in the workspace stay behind the workspace’s own grants and the person’s consent. Given when a person who may change the workspace opens the app.

assign_preset_verdict

The verdict on actor assigning the saved grant set set in workspace: a grant on the set’s assign node allows that set alone, and otherwise the workspace’s grant action decides for every set, since assigning a set is granting what it holds.

block_grant

The grant that keeps person out of workspace: every kind denied on the whole workspace, given by granted_by.

block_grant_id

The id of the grant that bans person from a workspace.

comments

Where comments live in a workspace, at any depth.

current_role_grants

grants with each built-in role’s grants as role_rules defines them now, so a role’s rules have one definition and reach workspaces written before they changed.

device_panel

The grant letting the device’s panel, DEVICE_PANEL, read what the session publishes for it in workspace: the readings of its own resources that are nobody else’s to read, such as what the person copied. It reads them, and nothing about them: changing the device stays the person’s.

foreign_device_bound

What a person may do from a device that is not theirs, in any workspace: read and change content, ask first before reaching outside it, never govern.

governance_action

governance_actions

Every governance action of workspace: workspace:<id>/kind:tilo.room/action:*. More specific than the workspace’s resource, where the Editor’s rule denies governance, so a grant here decides each governance action whatever the grantee’s role says about the workspace’s resource.

is_code_defined

Whether grant is one the code defines and every read of a stored policy restores (crate::WorkspacePolicy::with_current_roles): a built-in role’s, or part of the room’s make-up (session_app, device_panel). Whatever narrows a policy and reads it back narrows these again.

is_device_panel

Whether grant is the one device_panel makes: part of the workspace’s make-up, like session_app’s.

is_legacy_administrator_grant

Whether grant is an administrator’s grant of workspace in the shape workspaces held before administrator_grant: the owner’s lasting Allow on the workspace’s resource, where it decides nothing an Editor’s role does not already deny. Anything else under the id (a Deny, an expiring grant) is not one, so rewriting never widens it.

is_role_grant

Whether grant is one of a built-in role’s grants: given to the role itself under a role:<role>:<index> id. Those are the code’s, from role_rules; a workspace’s own adjustments to a role are grants under other ids and custom presets assign preset: ids, so neither is one.

is_session_app

Whether grant is the one session_app makes: part of the workspace’s make-up, never one a person gave and may take back.

moderation

Where moderation lives in a workspace, at any depth.

preset_assign_node

The node of assigning the named grant set name in workspace: a grant on it lets someone assign that one set, and nothing else of the workspace.

preset_assigned

The set and rule a grant id assigns, when it places one of the workspace’s saved grant sets: preset:<mint>:<set>:<index> (Preset::assign).

reactions

Where reactions live in a workspace, at any depth.

restriction_grant

The grant that stops person changing anything in workspace until until_ms (Unix milliseconds, exclusive): undoable changes and outside effects denied on the whole workspace, reading left alone. It lapses by itself, so a temporary restriction needs nobody to come back and lift it.

restriction_grant_id

The id of the grant that restricts person in a workspace.

role_answered

The role the workspace’s answers for telling_nodes describe. A Commenter writes nowhere they ask, so reads as a Viewer.

role_preset

role_rules

The rules a role carries in workspace.

session_app

The grant making the desktop session’s own app, SESSION_APP, one of the person’s own apps in workspace: whatever the person may do there, it may do for them. It never reaches past the person it acts for, whose authority bounds every delegation.

telling_nodes

What one who cannot read workspace’s grants (a page) asks the workspace to learn its person’s role, in order: may they write anywhere in it, moderate it, and govern who holds which role. role_answered reads the answers.

workspace_resource

The workspace’s own resource: workspace:<id>/kind:tilo.room.

workspace_role_grants

Every role’s grants for a new workspace, given by its owner. Ids are role:<role>:<index>.