/**
 * RolePolicy — the deterministic role→authority model (Layer 0 + role ceilings).
 *
 * Pure, synchronous, fully unit-testable. No LLM, no I/O. This is the part of the
 * permission system that is STRUCTURE, not judgment: the floor and the role
 * ceilings are enumerated here and cannot be talked around.
 *
 * Design: docs/specs/SLACK-ORG-INTEGRATION-SPEC.md §6.4–6.6.
 */
import type { OrgRole, SensitivityTier, FloorAction } from './types.js';
/** The enumerated floor — actions that are NEVER discretionary (Layer 0). */
export declare const FLOOR_ACTIONS: readonly FloorAction[];
export declare function isFloorAction(x: string | undefined | null): x is FloorAction;
export interface RolePolicyConfig {
    /** Override one or more role ceilings (org-configurable). */
    roleCeilings?: Partial<Record<OrgRole, SensitivityTier>>;
    /** Override which roles may authorize floor actions without a grant. */
    floorAuthorizedRoles?: OrgRole[];
}
export declare class RolePolicy {
    private readonly ceilings;
    private readonly floorRoles;
    constructor(config?: RolePolicyConfig);
    /** The highest tier this role may authorize on its own. */
    ceilingForRole(role: OrgRole): SensitivityTier;
    /** Does this role's ceiling cover the requested tier? */
    roleCoversTier(role: OrgRole, tier: SensitivityTier): boolean;
    /**
     * May this role authorize a FLOOR action without a separate grant?
     * Default: only `owner`. (An `admin` has a T4 ceiling but is NOT floor-authorized.)
     */
    roleCanAuthorizeFloor(role: OrgRole): boolean;
}
//# sourceMappingURL=RolePolicy.d.ts.map