Governed asset registry slice with asset creation, representations, metadata, lifecycle transitions, policy authorization, fail-closed denial, audit events, and version records

src/kontextual_engine/ports/policy.py

@@ -0,0 +1,38 @@
+"""Policy decision ports for application services."""
+
+from __future__ import annotations
+
+from typing import Any, Protocol
+
+from kontextual_engine.core import OperationContext, PolicyDecision
+
+
+class PolicyGateway(Protocol):
+    def authorize(
+        self,
+        context: OperationContext,
+        action: str,
+        resource: str,
+        *,
+        resource_metadata: dict[str, Any] | None = None,
+    ) -> PolicyDecision: ...
+
+
+class AllowAllPolicyGateway:
+    """Deterministic default for local development and tests."""
+
+    def authorize(
+        self,
+        context: OperationContext,
+        action: str,
+        resource: str,
+        *,
+        resource_metadata: dict[str, Any] | None = None,
+    ) -> PolicyDecision:
+        return PolicyDecision.allow(
+            context.actor.id,
+            action,
+            resource,
+            context={"gateway": "allow-all", "resource_metadata": resource_metadata or {}},
+        )
+