Fotbiler.RuleGate.Core 1.0.0

RuleGate Core

Local, provider-independent authorization engine for RuleGate.

Core contains the built-in policy engine, role and permission evaluators, logical requirements, typed attribute evaluators, requirement dispatch, in-memory policy storage and sources, immutable atomic policy snapshots, and opt-in authorization diagnostics. It emits exporter-neutral OpenTelemetry activities and low-cardinality metrics through the standard .NET diagnostics APIs. Logical requirement traversal is bounded and remains fail-closed when a tree exceeds the supported evaluation depth.

RuleGate 1.0 is stable. Public API compatibility follows Semantic Versioning.

Installation

dotnet add package Fotbiler.RuleGate.Core --version 1.0.0

Compatibility

This package targets .NET Standard 2.0, .NET 8, .NET 9, and .NET 10. Legacy runtime compatibility is verified through packed ASP.NET Core consumer applications.

When to use this package

Use Core when you need:

• In-process authorization without a remote policy service
• A framework-independent authorization engine
• Built-in role, permission, logical, scalar, collection, presence, and null attribute requirements
• Attribute-to-attribute comparisons for ownership and organization scope
• Recurring time-window, bounded date-time, authentication-age, and canonical context policies
• Custom policy-provider or evaluator composition
• Framework-independent policy-source loading and manual atomic reload
• Lock-free lookups against the last valid immutable policy snapshot
• Value-safe authorization, policy-load, and reload telemetry
• Direct control over authorization requests and decisions

ASP.NET Core applications should normally install Fotbiler.RuleGate.AspNetCore, which references Core and adds framework integration.

Evaluation behavior

RuleGate grants access only when:

1. A matching policy exists.
2. The complete requirement tree evaluates successfully.
3. No requirement is denied, unsupported, malformed, or indeterminate.

RuleGate follows default-deny behavior: missing policies and incomplete authorization inputs cannot grant access.

RuleGate packages

Documentation

• Getting started
• Authorization model
• Diagnostics
• Security model
• RuleGate CLI
• Policy testing
• Policy sources and atomic reload
• Telemetry, performance, and concurrency
• Documentation index

Security

RuleGate uses ordinal, case-sensitive matching by default and requires an explicit opt-in for ordinal case-insensitive string operations. Invalid types, unsupported operators, and collection-limit violations fail closed. Custom evaluators and policy providers must preserve these security boundaries.

Report suspected vulnerabilities through the private security reporting process.

License

RuleGate is licensed under the MIT License.

Runtime requirement depth

Runtime requirement evaluation is limited to a depth of 64. A requirement at depth 65 is not evaluated and produces an Indeterminate result with AuthorizationFailureCodes.RequirementDepthExceeded. Policy authorization maps that result to a denial. The limit is isolated per evaluation traversal and applies equally to built-in and custom requirement evaluators.