Bedrock Authorization Platform

EVALUATION ORDER
  1. Reachability gate   → resource must be reachable in the scope (when enabled)
  2. Delegation grant    → required when acting on behalf of another subject
  3. Resource policies   → explicit allow/deny (deny wins within the top priority group)
  4. Role-based perms    → subject → scope → role → permission (composed per permissionMode)
  5. Ownership           → an owner-role grant on an owned resource
  6. Resource hierarchy  → a parent resource can grant via a cascade: inherit edge

# 1. Create a scope, role, permission, and link them
curl -X POST '.../scopes'           -d '{"typeId":"org","name":"Acme Corp"}'
curl -X POST '.../roles'            -d '{"name":"Editor","scopeId":"scope_acme"}'
curl -X POST '.../permissions'      -d '{"scopeId":"scope_acme","action":"write","resourceType":"document","resourcePattern":"*","key":"document:write:*"}'
curl -X POST '.../role-permissions' -d '{"roleId":"role_editor","permissionId":"perm_1"}'

# 2. Add the subject as a member and assign the role
curl -X POST '.../memberships'      -d '{"subjectId":"subject_jane","scopeId":"scope_acme"}'
curl -X POST '.../role-assignments' -d '{"membershipId":"membership_1","roleId":"role_editor"}'

// 3. Evaluate with the embedded engine
import { BedrockEngine } from '@quarry-systems/bedrock-core';
import { createPostgresStore } from '@quarry-systems/bedrock-core-storage';

const bedrock = new BedrockEngine(createPostgresStore({ connectionString: process.env.DATABASE_URL }));

const decision = await bedrock.evaluate({
  actor: { subjectId: 'subject_jane', subjectType: 'user' },
  scopeId: 'scope_acme',
  action: 'write',
  resource: { resourceType: 'document', resourcePattern: '*' },
});

console.log(decision.allowed); // true

# Register an AI agent
curl -X POST '.../subjects' \
  -d '{"subjectType":"agent","externalId":"openai-assistant-123"}'

# Add to a scope with a restricted role (read-only in production)
curl -X POST '.../memberships' \
  -d '{"subjectId":"agent_assistant","scopeId":"scope_production"}'
curl -X POST '.../role-assignments' \
  -d '{"membershipId":"membership_agent","roleId":"role_readonly"}'