arc53-machine 82ec6cba0e feat(pat): enforce scopes and resource restrictions, deny by default ...

A central rule table maps each route and method to the scope a token needs;
a route that is not listed cannot be called with a token, and a test fails
when a registered route is left unclassified. Token management, admin, team
management, sign-in, device pairing and OAuth handshakes are never token
reachable, and a token never carries the admin role.

A token restricted to specific agents, sources, prompts, tools or workflows
is held to its allowlist: ids are checked wherever a route carries them,
listings are filtered, creation is refused, and routes whose rows cannot be
tied to the allowlist are closed. Agent import checks the resolved target.

2026-09-19 23:39:58 +01:00

..

__init__.py

refactor: rename the application package to docsgpt

2026-09-07 10:20:43 +01:00

routes.py

feat(pat): enforce scopes and resource restrictions, deny by default

2026-09-19 23:39:58 +01:00