nx_asset_access.nx
buildroot/runtime/nx_asset_access.nx
about
nx_asset_access.nx -- UNIVERSAL ORGANIZATION TOOLING arc, R6: ACCESS CLASSIFY (the asset PDP).
The operator's professional+private split + the image-stack "operator-only" law (search-by-image
is operator-only, deny-by-default, fail-closed): an asset is RELEASED to a requester ONLY IF the
requester's clearance level >= the level the record's `classification` field demands. Anything
else -- a missing classification, an unrecognized classification, or insufficient clearance -- is a
DENY. DENY-BY-DEFAULT + FAIL-CLOSED (Rule 12), exactly like nx_access_wall's PDP, but FOCUSED on
the one signal an asset record already carries (org_research.tsv private-vs-pro-acl).
ZERO new auth/crypto -- pure COMPOSITION (Rule 15): it DECODES the unified content-addressed record
via nx_asset_record (ar_decode / ar_get) and gates on its own classification field. The classification
travels INSIDE the canonical record bytes, so it is bound to the record's CID (change the class -> a
different CID): the access policy cannot be silently separated from the asset. This verdict is exactly
the L2/L5 identity-policy decision a daemon would feed into nx_access_wall's aw_decide (this organ is
the asset-aware policy; aw_decide stays the network/device/rate composition point).
No hardware/persistent-firmware writes (Rule 26). license_tier: ORIGINAL
dependencies 3 imports · 4 importers
imports: nx_syscalls.nxnx_uxf_decode.nxnx_asset_record.nx
imported by: nx_asset_access_gate.nxnx_asset_exceed_gate.nxnx_asset_visibility.nxnx_asset_visibility_gate.nx
structs
| none |
consts
| 29 | const AA_ALLOW: i64 = 1 |
| 30 | const AA_DENY_CLEARANCE: i64 = 0 - 1 // requester level below the record's required level |
| 31 | const AA_DENY_UNKNOWN: i64 = 0 - 2 // classification missing / unrecognized -> fail-closed |
functions
| 23 | func AA_ANON() -> i64 { return 0 } // public internet / unauthenticated |
| 24 | func AA_FAMILY() -> i64 { return 1 } // a family member called by 1: main |
| 25 | func AA_PRO() -> i64 { return 2 } // professional / staff |
| 26 | func AA_OWNER() -> i64 { return 3 } // the operator (lvl-3) |
| 33 | func aa_streq(a: *u8, b: *u8) -> i64 called by 1: aa_required_level |
| 45 | func aa_required_level(classification: *u8) -> i64 |
| 57 | func aa_decide(record_bytes: *u8, n: i64, requester_level: i64) -> i64 |
| 70 | func aa_allowed(verdict: i64) -> i64 { if verdict == AA_ALLOW { return 1 } return 0 } |