Per-workflow authorization engine as a GenServer.
Holds the ordered policy list and the engine State (labels, approvals), and
serializes evaluate/approve so concurrent phases never race the label state.
ALLOW and DENY decisions commit their labels immediately; ASK decisions commit
the prior-ALLOW labels but hold their own writes in escrow until approve/2.
Pending ASKs are keyed by evaluation route, so a spawn tree (one root route)
has at most one outstanding approval, and approve/2 releases it for the whole
tree.
Summary
Functions
Approve the pending ASK for route: release escrow and remember it.
Returns a specification to start this module under a supervisor.
Evaluate the policies at phase. Returns a Engine.Decision.
The current label snapshot.
Reject the pending ASK for route (drops it; no label change).
Start the engine.
Types
@type server() :: GenServer.server()
Functions
Approve the pending ASK for route: release escrow and remember it.
Returns a specification to start this module under a supervisor.
See Supervisor.
@spec evaluate(server(), atom(), map(), keyword()) :: Raxol.Agent.Authorization.Engine.Decision.t()
Evaluate the policies at phase. Returns a Engine.Decision.
The current label snapshot.
Reject the pending ASK for route (drops it; no label change).
@spec start_link(keyword()) :: GenServer.on_start()
Start the engine.
Options: :policies (ordered list), :labels, :monotonic, :name.