Core concepts

Scope

Every request carries a scope: tenant, environment, actor, channel, purpose, assurance level and auth level. Contexts take the scope as their first argument and authorize inside.

Command

Every mutation is a command: authorize → transaction → event → audit. Idempotency keys make retries safe.

Policy

Ordered rules over facts produce ALLOW, DENY, REVIEW, STEP_UP, MONITOR, REVOKE or QUARANTINE with a full explanation. Tenants publish versions; platform defaults apply otherwise.

Evidence → Verification → Decision

Authpermit stores what was collected (with hash and provenance), what checks ran (with model versions and thresholds) and what policy decided — so "why did Authpermit say verified?" is always answerable.

Audit ledger

Append-only, hash-chained per tenant, anchored daily with an HMAC held outside the database.