Interface: AccessDeniedEntry

Defined in: packages/audit-client/src/client.ts:68

A refusal recorded by the receiving module's own code, outside any transaction of its own.

Properties

actor

readonly actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }

Defined in: packages/audit-client/src/client.ts:80

The actor, or the platform actor when there was none to take. For a refusal by messaging's receiver it is the envelope's actor as claimed, not as verified: see AuditClient.accessDenyHook.

---

at?

readonly optional at?: Date

Defined in: packages/audit-client/src/client.ts:86

When it was refused. Defaults to now.

---

correlationId?

readonly optional correlationId?: string

Defined in: packages/audit-client/src/client.ts:84

Defaults to the ambient correlation id, else a new one.

---

messageId

readonly messageId: string

Defined in: packages/audit-client/src/client.ts:74

The refused message's id; the nil UUID when the envelope did not decode.

---

reason

readonly reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted" | "actor_token_invalid"

Defined in: packages/audit-client/src/client.ts:70

Why, copied unchanged into the record, which is a version 2 payload (D2.2).

---

schema

readonly schema: string

Defined in: packages/audit-client/src/client.ts:72

The registry key of the refused request.

---

tenant

readonly tenant: string

Defined in: packages/audit-client/src/client.ts:82

The tenant token the record is filed under.