blueclaw
Concepts

Policy

The policy document is the list of people and circles blueclaw serves, and the source every identity is derived from.

It is the file passed as --policy. People carry a personID, emails, a security level (securityLevelName, securityLevelRank), grantedClasses, circles and isAdmin. Circles carry a circleID, a workspaceDirectoryPath, and optional memberCircles naming circles that belong to them. resourceAccess maps resources to actions and circles. The validator (internal/policy/policy_validator.go) checks IDs, emails, duplicates, circles (at most 10 per person), channels, resources and retention.

At boot the daemon projects the policy into a read-only person table and into POSIX users and groups (see POSIX identity). The admin API validates, saves and reloads it (/admin/api/policy/*) and invites or removes people (/admin/api/people/*).

Approval

An approval is a person's answer to a tool call the host held before it ran.

Persona

The persona is three JSON documents that say who the agent is, how it carries itself, and how one person wants to be worked with.