AgentPrismPolicies

Namespace AgentPrism · Assembly AgentPrism.AspNetCore.dll

Role-based authorization policy names that AgentPrism defines.

public static class AgentPrismPolicies

Inheritance

object ← AgentPrismPolicies

Inherited Members

object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

AgentPrism stores no user and no role. Roles come from the consumer identity system; AgentPrism defines only the policy name, and the consumer binds those names to its own claims:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy(AgentPrismPolicies.Reader,   p => p.RequireRole("agentprism-reader",
                                                                     "agentprism-operator",
                                                                     "agentprism-admin"));
    options.AddPolicy(AgentPrismPolicies.Operator, p => p.RequireRole("agentprism-operator",
                                                                     "agentprism-admin"));
    options.AddPolicy(AgentPrismPolicies.Admin,    p => p.RequireRole("agentprism-admin"));
});

When a policy is not registered, that endpoint falls back to its earlier behavior (only the existing three-layer protection: loopback, bearer token, general authorization policy). Otherwise this role model would break the setup of everyone who updates, with a 403. A production setup can turn a missing policy into a startup failure with AgentPrismEndpointOptions.RequireRolePolicies.

Fields

Admin

Everything: writing an agent definition, adding an MCP server, deleting an approval rule, tenant management.

public const string Admin = "AgentPrism.Admin"

Field Value

string

Operator

Reader plus starting a run, granting an approval, deleting a session.

public const string Operator = "AgentPrism.Operator"

Field Value

string

Reader

Read access: agents, runs, sessions, traces, statistics.

public const string Reader = "AgentPrism.Reader"

Field Value

string