Decide who is allowed to do what

Sentry

Policy-based authorization with signed decisions.

Store authorization policies in ShrouDB and ask Sentry for a decision at request time. Each decision comes back signed, so another service can check it against Sentry's public keys instead of calling back. Policies are versioned, and POLICY HISTORY shows every past version.

Use it from your app

typescript

import { ShrouDB } from "@shroudb/sdk";

const db = new ShrouDB({
  moat: process.env.SHROUDB_URL,   // e.g. http://localhost:8200
  token: process.env.SHROUDB_TOKEN,
});

const decision = await db.sentry.evaluate(JSON.stringify({
  subject: user.id,
  action: "read",
  resource: `invoice/${invoiceId}`,
}));

// decision.decision is the outcome, decision.matched_policy says why,
// and decision.token is a signed record another service can verify.

What it does

Policies are stored in ShrouDB and versioned.
Every decision is signed and can be verified offline with JWKS.
POLICY HISTORY shows every past version of a policy.
Signing key rotation.

Turn it on

Sentry runs inside Moat, the ShrouDB server. Add this to moat.tomland restart. It shares Moat's encrypted storage, access tokens, and audit log with the other engines.

moat.toml

[engines.sentry]
enabled = true

Commands

Over RESP3, prefix each command with SENTRY. Over HTTP, send POST /v1/sentry {"args": [...]}. The SDKs have a method for each.

Command	Args	Description
POLICY CREATE	<name> <json>	Add a policy
POLICY UPDATE	<name> <json>	Change a policy (keeps history)
POLICY HISTORY	<name>	List past versions
EVALUATE	<json>	Get a signed decision
JWKS		Public keys for verifying decisions
KEY ROTATE		Rotate the signing key

Try Sentry locally

The quickstart takes about five minutes.

Quickstart All engines