TorbatYar/docs/reference/public-access-contract.md

Public Access Contract

Documentation contract only. No access-policy engine implementation.
Architecture: published-resource-architecture.md · ADR-022
Contract version: public-access.v1 (additive; open strategy registry)

---

1. Purpose

A Public Access Policy describes how a Published Resource may be reached. Strategies are composable and extensible. Experience stores policy metadata refs for presentation/publishing; it never owns authentication.

Concern	Owner
Authentication / SSO / session	Identity / Core (ADR-004, ADR-005)
Payment / paid unlock	Payment (ADR-020)
Membership / tier gates	Loyalty (ADR-011)
OTP / messaging challenges	Communication (ADR-012)
Publish presentation + access policy metadata	Experience

---

2. Access strategies (open registry)

Illustrative keys — not closed:

Strategy key	Meaning	Auth owner
public	Anyone with the URL	—
private	Not publicly listed; direct knowledge may still apply	—
authenticated	Any signed-in user	Identity
tenant_members	Members of the tenant	Core / Identity
role_based	Specific roles/permissions	Identity / Core entitlement
password_protected	Shared password challenge	Identity / Experience metadata + Identity verify
otp_protected	OTP challenge	Communication + Identity
paid_access	Unlock after payment	Payment (publish_id)
invitation_only	Invite token / list	Identity / Core
signed_url	Cryptographic signed link	Platform edge / Identity
temporary_link	Time-bound link	Short Link / Identity
expiration	Absolute/relative expiry on access	Policy metadata
rate_limited	Request rate caps	Edge / platform
geo_restricted	Reserved	Future
future.*	Any registered strategy	Declared owning service

---

3. Policy record (conceptual)

PublicAccessPolicy {
  publish_id
  tenant_id
  strategies[]          # ordered / composed
  strategy_config_refs  # opaque refs to owning services
  expires_at?
  rate_limit_ref?
}

Consumers evaluate access by consulting the owning service for each strategy, keyed by publish_id. Experience does not become an IdP.

---

4. Rules

1. Experience MUST NOT own authentication, password hashing as IdP, OTP providers, payment capture, or loyalty membership ledgers.
2. paid_access always references Payment via publish_id.
3. otp_protected always routes challenges through Communication.
4. Additive: resources with no policy default conceptually to public when publish_status=published and visibility=public (implementation deferred).
5. Geo restriction is reserved — document only.

---

5. Related

• Published Action Registry
• Embed Contract
• Published Resource Contracts