Enterprise

Fail-closed defaults you can take to a review

Signed decision batches, OCSF-shaped events, SCIM into a store you own, CAEP and SSF session revoke, FAPI 2.0 on the JWT path, and a Cloud you can skip.

Contact Threat model

Signed evidence

typ permdock-decisions+jwt. Compact JWS, one private claim.

Directory you own

SCIM into DirectoryStore. Cloud holds no copy.

Self-hosting

In-process defaults ship in the MIT package.

Fail-closed

No grant, unknown role, invalid boundary data, unrecognised remote decision, or a thrown closure all deny. can() never throws.

Deny overrides allow

Allows OR together. Any matching deny wins.

Never emit service_role

Generated RLS never uses service_role. The database stays on the caller subject.

Never a model-supplied subject

Agents do not pick who they are. The subject comes from subjectFrom*, the request, or the session.

Never a default tenant

A requested tenant with no matching membership is no tenant. Team ids are identifiers, never display names.

Contact

Security, procurement and Cloud questions.