3tears-agent-acl
Shared RBAC primitives for the 3tears platform: evaluator, cache, canonical Collections, loader adapters, and NATS invalidation payload models.
Purpose
Single source of truth for "can actor do action on namespace" decisions PLUS the persistence layer that feeds them. The same pure-Python evaluator, canonical Collections, and loader adapters run in every consuming application, so authorization answers are byte-identical across processes and one set of unit tests covers every caller.
The Collections, loaders, and invalidation models are reusable across
any 3tears app. The package supersedes per-resource ACL code paths
(namespace_grants, workspace-specific checks, tool-access fnmatch
lists).
Public API
Exports (see src/threetears/agent/acl/__init__.py):
Evaluation
evaluate_decision(ctx, *, cache: AclCache) -> bool-- fast yes/no hot path. The cache is consulted for membership and per-namespace contribution layers on every call, falling back to its loaders only on cache miss; production hit rate against repeated authz checks for the same(actor, namespace)is ~100% within the cache TTL.evaluate_with_trail(ctx, *, cache) -> EvaluationResult-- introspection path returning every(group, assignment, role) -> contributed_actionschain pluslimiting_sidefor user×agent intersection queries. Uses the same cache layers asevaluate_decision; trails are stored alongside the action set so successive decision-mode and trail-mode calls for the same actor + namespace serve from cache.evaluate_file_access(*, namespace, user_id, agent_id, path, direction, cache) -> bool-- workspace path-glob gate; same cache semantics.authorize(*, namespace_collection, namespace_name, action, user_id, agent_id, cache) -> EvaluationResult-- canonical authorization primitive every app's resource-typed wrapper is built on. Looks up the namespace by name, runsevaluate_with_trailthrough the cache, raises genericAccessDeniedon deny /NamespaceNotFoundon missing row.authorize_with_trail-- variant returning(result, ns_entity)for wrappers needing the entity.AccessDenied/NamespaceNotFound-- generic + namespace-miss exception classes; per-resource wrappers subclassAccessDeniedto carry typed catching at endpoint code (e.g.MemoryAccessDenied,DatasourceAccessDenied).AclCache-- three-layer in-process cache (actor -> [GroupMembership], `(group_id, namespace_id) -> action_set- trails
,(group_id, namespace_type, customer_id) -> action_set - trails
). Nothing in it ages: it is evicted row by row from the access tables' row broadcasts and follows their write generations (generation_follow.follow_access_tables), and serves what it holds only while those watches run. TheActorMembershipEntry` carries the full memberships tuple so the evaluator's cross-customer + member-type filter runs against cached state.
- trails
Persistence
GroupCollection,GroupMemberCollection,RoleCollection,RoleAssignmentCollection,NamespaceCollection-- three-tierSchemaBackedCollectionsubclasses fronting the canonical RBAC tables (groups,group_members,roles,role_assignments,namespaces). Schemas use canonical RBAC names with no deploy-specific schema prefix; the prefix is set on the L3 pool'ssearch_path, not in the schema name on the Collection.GroupEntity,GroupMemberEntity,RoleEntity,RoleAssignmentEntity,NamespaceEntity--BaseEntitysubclasses; four use composite primary keys post-row_scope partitioning ((row_scope, id)for groups / role_assignments / namespaces;(group_id, id)for group_members).CollectionMembershipLoader,CollectionGrantLoader-- concrete loader adapters satisfying theMembershipLoader/GrantLoaderProtocols, wired against the canonical Collections.
Invalidation
generation_follow.follow_access_tables(registry, cache, reader)-- binds anAclCacheto the access tables' row broadcasts and follows their write generations (epoch-task-06); the only invalidation there is.generation_follow.follow_caller_access_cache(registry, cache, reader)does the same for aCallerAccessCache. Both return anAccessTableFollowingwhosestop()undoes the bind and the follow.threetears.agent.acl.generation_followneeds thefollowextra: install3tears-agent-acl[follow], which brings3tears-epochand the NATS client. The watches arethreetears.epoch.TableFollower, the family's follower for any table; the plain install does not include it, and importing the module without it raisesModuleNotFoundError.evict_after_rbac_write(cache, member_actors=..., group_ids=...)-- what a helper that writes an rbac row evicts from its own cache at once.
Value types & protocols
- Value types:
Group,GroupMembership,Role,RoleAssignment,Namespace,EvaluationContext,EvaluationResult,Trail. - Enums:
ActorType,MemberType,ScopeType,LimitingSide. - I/O protocols:
GrantLoader,MembershipLoader-- callers may implement these against any persistence layer; the canonicalCollection*Loaderadapters above are the reference impls.
Consuming the package from a 3tears app
Each app constructs the canonical Collections against its own L3
pool (direct asyncpg in a server-style deployment, NATS-proxied L3 in
each agent pod) and wires the canonical loader adapters + cache.
Deployment-specific admin query shapes (dynamic list_by_filter /
per-cardinality counts / multi-table discovery JOINs) live on
consuming-app subclasses.
from threetears.agent.acl import (
AclCache,
CollectionGrantLoader,
CollectionMembershipLoader,
EvaluationContext,
GroupCollection,
GroupMemberCollection,
NamespaceCollection,
RoleAssignmentCollection,
RoleCollection,
evaluate_decision,
)
# 1. construct Collections against your registry / L3 pool
group_collection = GroupCollection(registry=registry, config=core_config)
group_member_collection = GroupMemberCollection(registry=registry, config=core_config)
role_collection = RoleCollection(registry=registry, config=core_config)
role_assignment_collection = RoleAssignmentCollection(registry=registry, config=core_config)
namespace_collection = NamespaceCollection(registry=registry, config=core_config)
# 2. wire the canonical loaders
membership_loader = CollectionMembershipLoader(collection=group_member_collection)
grant_loader = CollectionGrantLoader(
assignment_collection=role_assignment_collection,
role_collection=role_collection,
group_collection=group_collection,
)
# 3. build the cache
cache = AclCache(
membership_loader=membership_loader,
grant_loader=grant_loader,
)
# 4. evaluate
ctx = EvaluationContext(
namespace=target_namespace,
action="read",
user_id=user_id,
agent_id=agent_id,
)
allowed = await evaluate_decision(
ctx,
membership_loader=membership_loader,
grant_loader=grant_loader,
)
Implicit ownership: if namespace.owner_agent_id == ctx.agent_id,
the agent side short-circuits to full permissions with no group
lookup or assignment query. Ownership is a property of the namespace
row, never a grant.
1 maintainer
Metadata
1 maintainer
Release files for 3tears-agent-acl 0.71.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| 3tears_agent_acl-0.71.0.tar.gz | 204.1 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| 3tears_agent_acl-0.71.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 331.7 kB
Release files / 3tears_agent_acl-0.71.0.tar.gz
| Download URL | 3tears_agent_acl-0.71.0.tar.gz |
|---|---|
| Size | 204.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3b387bfcd054430c4dd835d8b1966554249dd424b7c10265977316da796c405c
|
|
BLAKE2b-256 checksum How to use checksums |
770b23e4084a9d5cb626115f02f545e359804fd48dc7e0c66e6073165821a08c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / 3tears_agent_acl-0.71.0-py3-none-any.whl
| Download URL | 3tears_agent_acl-0.71.0-py3-none-any.whl |
|---|---|
| Size | 127.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
bf3d82fe4d9094a6fac94dff33a8fa8faa2375b74d662b66779eff656879d943
|
|
BLAKE2b-256 checksum How to use checksums |
caad0cb66ee84af7c6b24ddf76e75b777878663f428871800aecc7ca2ed1a3f0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logSecurity for 3tears-agent-acl 0.71.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for 3tears_agent_acl-0.71.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
