import type { AuthorizationCapability, AuthorizationGrant, AuthorizationScope, AuthorizationTarget, OrganizationMembership, OrganizationRoleTemplate } from './types';
export declare const AUTHORIZATION_CAPABILITIES: readonly AuthorizationCapability[];
export interface AuthorizationDecision {
    allowed: boolean;
    reason: 'inactive-membership' | 'scope-mismatch' | 'explicit-deny' | 'explicit-allow' | 'role-template' | 'missing-capability';
    inheritedFrom?: {
        kind: 'membership' | 'grant';
        id: string;
        scope: AuthorizationScope;
    };
}
export declare function roleCapabilities(role: OrganizationRoleTemplate): ReadonlySet<AuthorizationCapability>;
export declare function scopeContains(scope: AuthorizationScope, target: AuthorizationTarget): boolean;
export declare function authorizeOrganization(input: {
    membership: OrganizationMembership | undefined;
    grants: readonly AuthorizationGrant[];
    capability: AuthorizationCapability;
    target: AuthorizationTarget;
}): AuthorizationDecision;
export declare function effectiveCapabilities(input: {
    membership: OrganizationMembership | undefined;
    grants: readonly AuthorizationGrant[];
    target: AuthorizationTarget;
}): AuthorizationCapability[];
