Technology & security

interface Decision { authenticated: boolean; authorized: boolean; integrityOk: boolean }

export function canMutateResource(input: Decision): boolean {
  return input.authenticated && input.authorized && input.integrityOk;
}

A client or attestation verdict cannot grant access to someone else's object.

CREATE TABLE operation_requests (
  tenant_id text NOT NULL,
  operation_key text NOT NULL,
  request_fingerprint text NOT NULL,
  status text NOT NULL,
  response_json jsonb,
  created_at timestamptz NOT NULL DEFAULT now(),
  PRIMARY KEY (tenant_id, operation_key)
);

A uniqueness constraint is the foundation for atomic operation claims.

export function authEvent(input: {
  operation: string; outcome: 'allowed' | 'denied';
  token?: string; password?: string;
}) {
  return {
    event: 'auth.decision',
    operation: input.operation,
    outcome: input.outcome
  };
}

Create a structured outcome without recording the input's token or password.