Raxol.AgentClientProtocol.Ext.AttachPolicy.Token (Raxol Agent Client Protocol v0.1.0)

Copy Markdown View Source

The capability-token attach policy.

Deny-by-default for anonymous attach: a tokenless attach denies (:token_required, the downgrade arm) BEFORE any verify runs. A present token is verified offline (one Capability.Token.verify/4), then the actor and surface bindings are checked:

  • actor — the signed act claim is the grant identity. If ctx.actor is asserted and its "id" differs from the token's, deny :actor_mismatch (fail-closed).
  • surface — if the token carries surf (a list of surface strings), ctx.surface (an atom, Connection-sourced) MUST be a member, else :surface_not_allowed. Absent surf ⇒ unrestricted.

now is server-sourced (System.os_time(:second) read here), never peer input. ctx.transport is ignored (a token gates the protocol path regardless of transport). The policy consults NO live state, so its decision is identical with and without a live Writer.