/**
 * RBAC (Role-Based Access Control) enforcer for secrets management admin API.
 *
 * Provides a fixed 3-role permission model:
 * - owner: all permissions (manages tokens, rotates keys)
 * - admin: context + secret + audit management
 * - auditor: read-only access to contexts and audit logs (no secret values)
 */
/**
 * Fixed roles for the secrets management admin API.
 */
export type Role = 'owner' | 'admin' | 'auditor';
/**
 * Permissions for the secrets management admin API.
 */
export type Permission = 'context.create' | 'context.read' | 'context.update' | 'context.delete' | 'secret.read' | 'secret.write' | 'secret.delete' | 'secret.reveal' | 'audit.read' | 'token.manage' | 'key.rotate' | 'run.read' | 'run.cancel' | 'event_log.read' | 'event_log.read_payload' | 'access_log.read' | 'scheduled_job.trigger' | 'event_dlq.read' | 'event_dlq.manage';
/**
 * Error thrown when a role lacks the required permission.
 */
export declare class PermissionDeniedError extends Error {
    readonly role: Role;
    readonly permission: Permission;
    constructor(role: Role, permission: Permission);
}
/**
 * RBAC enforcer for the secrets management admin API.
 *
 * Checks role-based permissions using a static permission mapping.
 * No database or external state -- purely in-memory evaluation.
 */
export declare class RbacEnforcer {
    /**
     * Check whether a role has a specific permission.
     */
    hasPermission(role: Role, permission: Permission): boolean;
    /**
     * Require a permission, throwing PermissionDeniedError if not authorized.
     */
    requirePermission(role: Role, permission: Permission): void;
    /**
     * Check whether a role can access secret values (not just metadata).
     * Only owner and admin can see actual secret values.
     * Auditor can see context metadata and audit logs but NOT secret values.
     */
    canAccessSecretValues(role: Role): boolean;
}
//# sourceMappingURL=rbac.d.ts.map