Snider
|
ec423cfe46
|
feat: implement Section 21 — Entitlement permission primitive
c.Entitled("action", quantity) checks permission before execution.
Default: everything permitted (trusted conclave).
Consumer packages replace checker via c.SetEntitlementChecker().
- Entitlement struct: Allowed, Unlimited, Limit, Used, Remaining, Reason
- NearLimit(threshold), UsagePercent() convenience methods
- EntitlementChecker function type — registered by go-entitlements/commerce-matrix
- UsageRecorder for consumption tracking after gated actions succeed
- Enforcement wired into Action.Run() — one gate for all capabilities
- Security audit logging on denials (P11-6)
- 16 AX-7 tests including full SaaS gating pattern simulation
Maps 1:1 to RFC-004 EntitlementResult and RFC-005 PermissionResult.
Co-Authored-By: Virgil <virgil@lethean.io>
|
2026-03-25 16:17:16 +00:00 |
|