# Reference index [#reference-index] Find a name, then follow the link to the page that defines it. ## Entry points [#entry-points] | Import | Names | Page | | ------------------------------ | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | `@aventara/access` | `definePolicies`, `createAccessEngine`, `defineGuardrails`, `policiesHash`, `guardrailsHash`, `AccessError` | [Rules](/access/docs/rules), [Reference](/access/docs/reference), [Guardrails](/access/docs/guardrails) | | `@aventara/access/auth` | `createAccess`, `agentOf` | [createAccess](/access/docs/create-access), [Agents over MCP](/access/docs/agents-mcp) | | `@aventara/access/better-auth` | `aventaraAccess`, `accessOf`, `aventaraAccessClient`, `agentOf` | [The Better Auth plugin](/access/docs/better-auth-plugin) | | `@aventara/access/standalone` | `serve` | [Hosts](/access/docs/hosts#standalone) | | `avaccess` | `push`, `pull`, `verify`, `status`, `diff`, `keys`, `generate`, `schema`, `serve` | [CLI reference](/access/docs/cli-reference) | ## The rules builder [#the-rules-builder] | Call | Page | | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | `definePolicies(model, { namespace })` | [Rules](/access/docs/rules), [Namespaces](/access/docs/registry-and-cli#namespaces) | | `.principal

()`, `.roles()`, `.govern()`, `.grants()`, `.denies()` | [Rules](/access/docs/rules#the-building-blocks) | | `grant(subjects, actions, resources, { name, where, in, fields, after, write })` | [Rules](/access/docs/rules), [Updates](/access/docs/updates) | | `deny(actions, resources, { name, where, if: { claims, origin } })` | [Rules](/access/docs/rules) | | `.contract()`, `.engine(options)` | [Rules](/access/docs/rules), [Reference](/access/docs/reference#the-engine) | | `defineGuardrails({ claims }).denies()` | [Guardrails](/access/docs/guardrails) | ## The engine [#the-engine] | Member | Page | | -------------------------------------------------- | ------------------------------------------------------------------------ | | `can`, `scopeOf`, `fieldsOf` | [Rules](/access/docs/rules#asking-the-engine) | | `grantsOf`, and `beforeGrants` on `can` | [Updates](/access/docs/updates) | | `explain` | [Rules](/access/docs/rules#asking-the-engine) | | `checkBeacons` | [Beacons and `foreign`](/access/docs/beacons-and-foreign#at-startup) | | `governed`, `afterChecks`, `paths` | [Reference](/access/docs/reference#the-engine) | | Engine options `guardrails`, `lock`, `requireLock` | [The lock at startup](/access/docs/registry-and-cli#the-lock-at-startup) | ## createAccess options [#createaccess-options] | Option | Page | | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | `betterAuth`, `policies` (`rules`, `claims`, `claimsOf`, `guardrails`, `lock`, `requireLock`, `tokenTtl`), `principal` | [createAccess](/access/docs/create-access#the-levers) | | `profile` (`web`, `service`, `kiosk`) | [createAccess](/access/docs/create-access#profiles), [The kiosk profile](/access/docs/kiosk) | | `registry` (`enabled`, `ownership`) | [Namespaces, the registry and the CLI](/access/docs/registry-and-cli) | | `audit` | [The audit log](/access/docs/audit-log) | | `resources` (`users`, `members`, `authTables`) | [Better Auth tables as Resources](/access/docs/auth-tables) | | `passwords` (`argon2id`, `legacyScrypt`) | [Passwords](/access/docs/passwords) | | `mcp` (`resource`, `openRegistration`), `audience` | [Agents over MCP](/access/docs/agents-mcp) | `aventaraAccess()` takes the same blocks, plus `organization` ([The organization bridge](/access/docs/better-auth-plugin#the-organization-bridge)). ## The instance [#the-instance] | Member | Page | | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `handler`, `api`, `options`, `$Infer`, `policy`, `state`, `registry`, `client`, `kiosk`, `mcp`, `beacon` | [createAccess](/access/docs/create-access#what-the-instance-holds) | | `client.verbs`: `signIn`, `signUp`, `signOut`, `resetPassword`, `me` | [The $access verbs](/access/docs/access-verbs) | | `kiosk.listDevices()`, `kiosk.revokeDevice()` | [The kiosk profile](/access/docs/kiosk#your-servers-own-calls) | | `registry.createNamespace`, `rotateKey`, `revokeKey`, `assignResource`, `releaseResource`, `pushGuardrails` | [Registry](/access/docs/registry-and-cli) | | `authClient.access.can` | [The client plugin](/access/docs/better-auth-plugin#the-client-plugin) | ## Routes [#routes] | Route | Page | | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Better Auth's routes under `/api/auth`, plus `GET /me`, `GET /token`, `GET /jwks` | [Hosts](/access/docs/hosts), [createAccess](/access/docs/create-access#tokens-and-sessions) | | `/access/v1/...` (the registry) | [Registry](/access/docs/registry-and-cli#the-server) | | `/kiosk/...` | [The kiosk profile](/access/docs/kiosk#the-verbs-and-routes) | | `POST {api}/_access/can` (the framework's) | [The $access verbs](/access/docs/access-verbs) | | `GET /health` (standalone server) | [Hosts](/access/docs/hosts#standalone) | ## Files and formats [#files-and-formats] | File | Page | | -------------------------------------------------------------------------------- | --------------------------------------------------------- | | `aventara-access/policies@1`, `guardrails@1`, `lock@1`, `foreign@1`, `beacons@1` | [File formats](/access/docs/reference#file-formats) | | `avAccess.lock.json` | [The lock](/access/docs/registry-and-cli#the-lock) | | `avAccess.beacons..json` | [Beacons and `foreign`](/access/docs/beacons-and-foreign) | | `src/generated/avAccess.ts` | [The generated client](/access/docs/generated-client) | ## Lookups [#lookups] | I want | Page | | ---------------------------------------- | ---------------------------------------------------------- | | A CLI flag or environment variable | [CLI reference](/access/docs/cli-reference) | | An error code | [Error codes](/access/docs/error-codes) | | A default, bound or timing | [Limits and defaults](/access/docs/limits-and-defaults) | | A word I do not know | [Glossary](/access/docs/glossary) | | A message I see | [Troubleshooting](/access/docs/troubleshooting) | | What the framework does with the answers | [Policies](/framework/docs/policies) in the framework docs |