Interface AuthorizationDiagnosticsOptions

Authorization decision-explanation options (M98h).

Opt-in observation of the first-party RBAC evaluation. enabled must be true; the option is validated at construction, so a malformed option — including enabled: false from a caller the literal type cannot reach — refuses before any application exists, with a fixed, value-free message.

roles and permissions are exact-name → display-alias maps for the rules the explanations may name. Every alias and the optional policyRevision carry M98d's shape rule verbatim: non-empty UTF-8, 1–64 bytes, no control character, unique within its map. Up to 128 entries per map. A decision whose requested rules are not ALL approved is dropped before buffering and counted in the batch's droppedUnapproved — partial rule lists are never emitted, because a position in a partial list still identifies the rule. A granting principal role is reported only when it has an approved role alias.