nx_authz.nx

nx_authz.nx -- per-realm PERMISSION LEVELS (authorization), the layer ON TOP of OPAQUE authentication. OPAQUE answers "who are you (valid session) + which realm"; THIS answers "what may THIS user SEE/DO" -- so "all users" do NOT share the same access (operator 2026-06-17: nishifamily nsfw/private not shared by everyone; andelinwest lawyers and clients on different permission levels). Model (data-driven, rule 11): * each realm has a RESOURCE POLICY = parallel arrays (path-prefix, required_level) * each user has a LEVEL within that realm (higher = more access) * authz_level_allow = LONGEST-PREFIX matching rule's required_level <= user's level ? ALLOW : DENY, DENY-BY-DEFAULT (an unlisted resource is denied). Realm-scoped: each realm supplies its OWN policy + user tables, so a nishifamily level never grants an andelinwest resource. Reuses nx_vault_acl (acl_is_prefix -- the same least-privilege longest-prefix primitive; no reinvention). A daemon composes: nx_sa_validate (authn -> handle+realm) -> authz_level_of(handle) -> authz_level_allow(level, resource). For finer per-user/per-record scoping (e.g. client A's case vs B's), use nx_vault_acl acl_eval with a per-user policy; THIS organ is the hierarchical-level common case. license_tier: ORIGINAL