export type RbacRole = 'Admin' | 'Architect' | 'Developer' | 'Reviewer' | 'Observer';
export type PermissionAction = 'create' | 'read' | 'update' | 'delete' | 'approve' | 'implement' | 'configure';
export interface Permission {
    action: PermissionAction;
    resource: string;
    specId?: string;
}
export interface PermissionResult {
    allowed: boolean;
    role?: RbacRole;
    reason: string;
}
/** A role assignment binds a user to a role, optionally scoped to a spec. */
export interface RoleAssignment {
    userId: string;
    role: RbacRole;
    /** When set, this assignment only applies to the given spec (spec-level override). */
    specId?: string;
    assignedAt: string;
    assignedBy?: string;
}
export interface RbacConfig {
    /** When false (default), RBAC is disabled — all operations allowed (single-user mode). */
    enabled: boolean;
    projectId: string;
    assignments: RoleAssignment[];
    updatedAt: string;
}
export interface ConfigureRolesInput {
    projectId: string;
    /** Enable or disable RBAC for the project. */
    enabled: boolean;
}
export interface AssignRoleInput {
    projectId: string;
    userId: string;
    role: RbacRole;
    /** Optional: scope the assignment to a specific spec. */
    specId?: string;
    assignedBy?: string;
}
export interface RbacAuditEntry {
    timestamp: string;
    userId: string;
    action: PermissionAction;
    resource: string;
    specId?: string;
    result: 'allowed' | 'denied';
    role?: RbacRole;
}
//# sourceMappingURL=rbac.d.ts.map