cayu.approvals.actors

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

ResolutionActor

from cayu.approvals import ResolutionActor

Typed actor identity for trusted runtime operator actions.

Stamped into approval, user-input, recovery, and interruption event payloads so the audit trail answers who performed an operator action without consulting app-side state. reason and metadata on requests remain caller-claimed free-form data; this model is the provenance field.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
subject	str	required
tenant	str | None	None
source	ResolutionActorSource | None	None
claims	dict[str, Any]	Field(default_factory=dict)

validate_nonblank_strings (method)

ResolutionActor.validate_nonblank_strings(value: str | None, info) -> str | None

copy_claims (method)

ResolutionActor.copy_claims(value: dict[str, Any]) -> dict[str, Any]

validate_reserved_subject (method)

ResolutionActor.validate_reserved_subject() -> ResolutionActor

Release source · Runtime guarantees · Capability guides

ResolutionActorSource

from cayu.approvals import ResolutionActorSource

How a ResolutionActor’s identity claim was established.

HTTP_AUTH is produced only by the server layer from a verified AuthContext; REQUEST marks a caller-asserted identity (SDK or open-access HTTP body); SYSTEM marks runtime-generated actors such as deterministic approval expiry. Direct SDK callers are a trusted boundary and may construct system actors; HTTP bodies cannot — the server re-stamps open-access bodies to REQUEST and rejects them entirely under auth.

Bases: StrEnum.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
HTTP_AUTH	class attribute	'http_auth'
REQUEST	class attribute	'request'
SYSTEM	class attribute	'system'

Release source · Runtime guarantees · Capability guides