Discover and propose complete authorization allow guards
ProprietaryDiscover protected native calls and bind reusable authorization result contracts throughout the input source set. Derive program identities, statement locations and COPY snapshots. Reuse current invocation, unchanged input, numeric denial witness and terminal-exit proofs. Require the complete explicit allow condition before protected work when a concrete non-allow result can reach it. Preserve existing messages, statements and rejection behavior under the approved contract. Forged responses, changed inputs and unknown effects remain barriers. Locate candidates by syntax identity after earlier insertions and record every proof outcome. No source paths, program IDs, statement lines or caller hashes are required. Identity and resource correctness remain separate proofs. Application team review remains required.
io.Optional
Strict JSON with version 1 and a rules array. Each rule supplies id, authorizationRoutine, authorizationArguments, responseArgument, allowCondition, allowValues, protectedRoutine, protectedArguments, watchedRecords, approvedExit and contractSource. The reusable contract approves complete interfaces, current response semantics, the complete allow set, unchanged watched inputs and terminal rejection at every matching protected call. Conflicting protected-routine policies prevent changes. Omit this option to inventory native calls without edits.
mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.