cayu.knowledge.scopes

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

knowledge_access_scope_sha256

from cayu.storage import knowledge_access_scope_sha256

Return the canonical public identity of one enforced knowledge access scope.

knowledge_access_scope_sha256(scope: KnowledgeAccessScope) -> str

Release source · Runtime guarantees · Capability guides

KnowledgeAccessDenied

from cayu.storage import KnowledgeAccessDenied

Raised when a knowledge mutation falls outside its explicit access scope.

Bases: PermissionError.

init (method)

KnowledgeAccessDenied.__init__(operation: str) -> None

Release source · Runtime guarantees · Capability guides

KnowledgeAccessScope

from cayu.storage import KnowledgeAccessScope

Principal-derived constraints enforced inside every knowledge operation.

Cayu deliberately does not model tenants, organizations, users, or RBAC. The hosting application maps those concepts into namespaces, labels, visibility, source identity, lifecycle state, and expiration eligibility. Namespace-wide access must be explicit; constructing a scope with no namespace is invalid.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
resource_constraints	tuple[str, ...]	Field(default=(), exclude_if=lambda v: not v)
allowed_namespaces	list[str]	Field(default_factory=list)
allow_all_namespaces	bool	False
required_labels	dict[str, str]	Field(default_factory=dict)
allowed_visibilities	list[KnowledgeVisibility]	Field(default_factory=lambda: [KnowledgeVisibility.GLOBAL])
allowed_source_types	list[str] | None	None
allowed_source_ids	list[str] | None	None
allowed_statuses	list[KnowledgeStatus]	Field(default_factory=lambda: [KnowledgeStatus.ACTIVE])
include_expired	bool	False

validate_resource_constraints (method)

KnowledgeAccessScope.validate_resource_constraints(values)

copy_string_lists (method)

KnowledgeAccessScope.copy_string_lists(value, info) -> list[str] | None

copy_required_labels (method)

KnowledgeAccessScope.copy_required_labels(value) -> dict[str, str]

validate_nonempty_enum_lists (method)

KnowledgeAccessScope.validate_nonempty_enum_lists(value: list[Any], info) -> list[Any]

validate_boolean_fields (method)

KnowledgeAccessScope.validate_boolean_fields(value, info) -> bool

validate_namespace_boundary (method)

KnowledgeAccessScope.validate_namespace_boundary() -> KnowledgeAccessScope

for_namespace (method)

KnowledgeAccessScope.for_namespace(namespace: str, *, required_labels: dict[str, str] | None=None, allowed_visibilities: list[KnowledgeVisibility] | None=None, allowed_source_types: list[str] | None=None, allowed_source_ids: list[str] | None=None, allowed_statuses: list[KnowledgeStatus] | None=None, include_expired: bool=False) -> KnowledgeAccessScope

Create an explicit single-namespace application scope.

privileged (method)

KnowledgeAccessScope.privileged() -> KnowledgeAccessScope

Create an explicit all-knowledge scope for trusted host maintenance.

Release source · Runtime guarantees · Capability guides