# Aventara Access

> Authorization, typed from your schema. Every row. Every field.

Version: 1.0.0-rc.2. Release candidate; breaking changes are possible before a stable release. Links are relative to this deployment.

## Complete documentation

- [Full Markdown](/access/llms-full.txt): All published Access pages.

## Start building

- [Introduction](/access/markdown/introduction): What Aventara Access is, its parts, its status and what it needs.
- [Why Access](/access/markdown/why-access): The problem Access solves, what it decides and what it leaves to Better Auth and to you.
- [Installation](/access/markdown/installation): Requirements, the exact install commands and which optional packages go with which feature.
- [Getting started](/access/markdown/getting-started): Add Access to a new Aventara app: rules, sign-in, a token, and a first refused request.

## Writing rules

- [Rules](/access/markdown/rules): definePolicies: roles, grants, denies, governed fields and the principal type, plus the four questions the engine answers.
- [Updates, grantsOf and beforeGrants](/access/markdown/updates): How Access checks an update twice, and how the row before reaches can.

## Identity & integration

- [createAccess](/access/markdown/create-access): Better Auth with Access beside it: the options, claims, principal, profiles, tokens and sessions.
- [Passwords](/access/markdown/passwords): Argon2id hashing: the default, the two profiles, rehashing at sign-in, moving off scrypt and Node.js 22.
- [Hosts](/access/markdown/hosts): Mount Access's routes in Next.js, NestJS, Express or the standalone server, and wire the engine into Aventara.
- [The $access verbs](/access/markdown/access-verbs): signIn, signUp, signOut, resetPassword and me: their routes, server calls and rate limits.
- [The Better Auth plugin](/access/markdown/better-auth-plugin): aventaraAccess(), accessOf, the organization bridge, the client plugin and the app as the hub.

## Agents & devices

- [Agents over MCP](/access/markdown/agents-mcp): Authorize AI agents with Better Auth's OAuth provider: scopes, registration and one audience per service.
- [The kiosk profile](/access/markdown/kiosk): Shared devices with staff switching by PIN: enrolling, locking, PIN limits, LAN without TLS and Expo apps.

## Data & records

- [Better Auth tables as Resources](/access/markdown/auth-tables): Which of Better Auth's tables the rules may open, which columns stay sealed, and authTables.
- [The audit log](/access/markdown/audit-log): What Access records, the table or sink, the event shapes, and how anonymous floods are folded.

## Multiple services

- [Namespaces, the registry and the CLI](/access/markdown/registry-and-cli): Several services, one Access server: namespaces, keys, ownership, push and pull, and the lock.
- [Guardrails](/access/markdown/guardrails): The org's deny-only rules that every namespace's engine adds on top of its own.
- [Beacons and foreign Resources](/access/markdown/beacons-and-foreign): Read another namespace's Resources in conditions, and prove both services share one database.
- [The generated client](/access/markdown/generated-client): Decide for a service that does not run on Aventara, with two generated TypeScript files.
- [The standalone server](/access/markdown/standalone-server): Run the standalone Access server with avaccess serve, on a machine or in a container you build.

## Reference

- [Reference index](/access/markdown/reference-index): Where to look things up: entry points, options, rules API, engine, CLI, files, codes, defaults and environment variables.
- [File formats, hashes and the engine](/access/markdown/reference): The passive JSON formats Access writes, their hashes, and the engine's members.
- [CLI reference](/access/markdown/cli-reference): Every avaccess command, flag, environment variable and exit code.
- [Error codes](/access/markdown/error-codes): Every AccessError code with its meaning and fix, every case of ACCESS_OPTIONS_INVALID, and the codes Access's routes answer with.
- [Limits and defaults](/access/markdown/limits-and-defaults): Every default, bound and timing in one place: tokens, passwords, the server, the registry, the kiosk and the audit log.
- [Troubleshooting](/access/markdown/troubleshooting): Fixes for startup refusals, version errors, locks, registry keys, refused requests and kiosk and agent problems, by the message you see.
- [Glossary](/access/markdown/glossary): The words Access uses: principal, claim, grant, deny, governed field, namespace, guardrail, beacon and more.

## About

- [License](/access/markdown/license): Aventara Access is licensed under PolyForm Shield 1.0.0 with an additional permission.