Find a name, then follow the link to the page that defines it.
Entry points
| Import | Names | Page |
|---|---|---|
@aventara/access | definePolicies, createAccessEngine, defineGuardrails, policiesHash, guardrailsHash, AccessError | Rules, Reference, Guardrails |
@aventara/access/auth | createAccess, agentOf | createAccess, Agents over MCP |
@aventara/access/better-auth | aventaraAccess, accessOf, aventaraAccessClient, agentOf | The Better Auth plugin |
@aventara/access/standalone | serve | Hosts |
avaccess | push, pull, verify, status, diff, keys, generate, schema, serve | CLI reference |
The rules builder
| Call | Page |
|---|---|
definePolicies(model, { namespace }) | Rules, Namespaces |
.principal<P>(), .roles(), .govern(), .grants(), .denies() | Rules |
grant(subjects, actions, resources, { name, where, in, fields, after, write }) | Rules, Updates |
deny(actions, resources, { name, where, if: { claims, origin } }) | Rules |
.contract(), .engine(options) | Rules, Reference |
defineGuardrails({ claims }).denies() | Guardrails |
The engine
| Member | Page |
|---|---|
can, scopeOf, fieldsOf | Rules |
grantsOf, and beforeGrants on can | Updates |
explain | Rules |
checkBeacons | Beacons and foreign |
governed, afterChecks, paths | Reference |
Engine options guardrails, lock, requireLock | The lock at startup |
createAccess options
| Option | Page |
|---|---|
betterAuth, policies (rules, claims, claimsOf, guardrails, lock, requireLock, tokenTtl), principal | createAccess |
profile (web, service, kiosk) | createAccess, The kiosk profile |
registry (enabled, ownership) | Namespaces, the registry and the CLI |
audit | The audit log |
resources (users, members, authTables) | Better Auth tables as Resources |
passwords (argon2id, legacyScrypt) | Passwords |
mcp (resource, openRegistration), audience | Agents over MCP |
aventaraAccess() takes the same blocks, plus organization (The organization bridge).
The instance
| Member | Page |
|---|---|
handler, api, options, $Infer, policy, state, registry, client, kiosk, mcp, beacon | createAccess |
client.verbs: signIn, signUp, signOut, resetPassword, me | The $access verbs |
kiosk.listDevices(), kiosk.revokeDevice() | The kiosk profile |
registry.createNamespace, rotateKey, revokeKey, assignResource, releaseResource, pushGuardrails | Registry |
authClient.access.can | The client plugin |
Routes
| Route | Page |
|---|---|
Better Auth's routes under /api/auth, plus GET /me, GET /token, GET /jwks | Hosts, createAccess |
/access/v1/... (the registry) | Registry |
/kiosk/... | The kiosk profile |
POST {api}/_access/can (the framework's) | The $access verbs |
GET /health (standalone server) | Hosts |
Files and formats
| File | Page |
|---|---|
aventara-access/policies@1, guardrails@1, lock@1, foreign@1, beacons@1 | File formats |
avAccess.lock.json | The lock |
avAccess.beacons.<env>.json | Beacons and foreign |
src/generated/avAccess.ts | The generated client |
Lookups
| I want | Page |
|---|---|
| A CLI flag or environment variable | CLI reference |
| An error code | Error codes |
| A default, bound or timing | Limits and defaults |
| A word I do not know | Glossary |
| A message I see | Troubleshooting |
| What the framework does with the answers | Policies in the framework docs |