code wiki / _hdl_build / nx_shard_guardrail.nx
nx_shard_guardrail.nx source
↩ module page · 17 lines · 1146 B
1// nx_shard_guardrail.nx -- CAP-SHARD-GUARDRAIL (cross-shard R4): org-level POLICY INHERITANCE. An org-default
2// required-level per action is inherited by EVERY shard; a shard may TIGHTEN it (demand a HIGHER level) but NEVER
3// LOOSEN it below the org floor -- so a tenant can't weaken a org-wide guardrail, only strengthen it for their own
4// shard. This is the AWS Organizations SCP / GCP Org-Policy inheritance guarantee, done deterministic + sovereign,
5// composing the level model (ag_resolve_level) over the shard registry. license_tier: ORIGINAL
6import "nx_syscalls.nx"
7
8// the EFFECTIVE required level for an action on a shard = max(org_default, shard_override): tighten-only.
9func gi_effective_required(org_required: i64, shard_required: i64) -> i64 {
10 if shard_required > org_required { return shard_required }
11 return org_required
12}
13// allow iff the caller's GRANTED level meets the EFFECTIVE requirement (org floor, possibly tightened by the shard).
14func gi_allowed(granted: i64, org_required: i64, shard_required: i64) -> i64 {
15 if granted >= gi_effective_required(org_required, shard_required) { return 1 }
16 return 0
17}