# dome-policy

TOML-based policy engine for Thunder Dome with default-deny authorization and hot-reload support.

## What it does

- Parses human-readable TOML policy files into typed authorization rules with glob and regex matchers for tools, identities, and argument constraints.
- Evaluates requests against rules in priority order (lowest number = highest priority), with first-match-wins semantics.
- Enforces default-deny: if no rule matches a request, it is denied.
- Supports identity matching by principal name or label (e.g., `role:admin`), and tool matching by exact name or glob pattern.
- **Time-window conditions** — rules can be scoped to specific time ranges and days of the week (e.g., business hours only).
- **Recursive argument inspection** — deny_regex and allow_glob constraints descend into nested JSON objects and arrays, preventing bypass via nested payloads.
- **Hot-reload** — `PolicyWatcher` monitors TOML files for changes and atomically swaps the engine via `Arc`, with file-system watcher and SIGHUP support.
- Returns structured `Decision` values with the matching rule ID, effect, and metadata for audit logging.

## Usage

```toml
[dependencies]
dome-policy = "0.4"
```

```rust
use dome_policy::{parse_policy, PolicyEngine, Identity};

let rules = parse_policy(toml_string)?;
let engine = PolicyEngine::new(rules)?;
let decision = engine.evaluate(&identity, "read_file", &args);
```

## Part of Thunder Dome

This crate is part of [Thunder Dome](https://github.com/Orellius/thunder-dome), a security gateway for the Model Context Protocol. See the main repository for full documentation.

## License

Apache-2.0
