The sentrykit package

Everything listed in sentrykit.__all__ is a re-export of a name that is defined — and documented — in one of the modules under core, policy or stores. Importing from the top level is the shorter spelling of the same object, never a different one, so from sentrykit import protect and from sentrykit.decorator import protect are interchangeable.

sentrykit.__version__ carries the release, and it is the same string the distribution metadata reports.

sentrykit — lightweight, framework-agnostic authorization built on AWS Cedar.

Clip protect() onto any callable and sentrykit decides, per call, whether the principal may invoke it, which arguments they may pass, and which defaults to inject when they pass none.

from sentrykit import Entity, EntityRef, Principal, establish, install, protect

install(
    '''
    @id("support-may-search")
    permit(
      principal in Role::"support",
      action == Action::"tool.search_orders",
      resource == Tool::"orders"
    );
    ''',
    entities=[Entity(EntityRef("Tool", "orders")), Entity(EntityRef("Role", "support"))],
)


@protect(action='Action::"tool.search_orders"', resource='Tool::"orders"')
def search_orders(customer_id: str, limit: int = 10) -> dict[str, object]:
    return {"customer_id": customer_id, "limit": limit}


with establish(Principal(id="alice", roles=("support",)), channel="agent"):
    search_orders(customer_id="c-1")

The caller proposes; the policy decides.