Fotbiler.RuleGate.Manifest 1.0.0

RuleGate Manifest

YAML manifest loading, validation, and policy compilation for RuleGate.

Manifest converts rulegate.yaml documents into immutable RuleGate policy definitions. Loading and validation failures are structured, and failed compilation does not return a partial policy collection. YAML files and embedded YAML resources can be used directly as reloadable policy sources. Bounded document, node, depth, scalar, collection, alias, and policy limits protect the loader and validator from resource-exhaustion input.

RuleGate 1.0 is stable. Public API and manifest compatibility follow Semantic Versioning.

Installation

dotnet add package Fotbiler.RuleGate.Manifest --version 1.0.0

Compatibility

This package targets .NET Standard 2.0, .NET 8, .NET 9, and .NET 10. Manifest compilation remains fail-closed on every target.

Example manifest

schemaVersion: 1

application:
  id: sample-application
  name: Sample Application

policies:
  - id: sample-resource-read
    resourceType: sample-resource
    action: read
    requirement:
      all:
        - permission: sample.read
        - role: sample.editor
        - attribute:
            source: subject
            name: departments
            operator: contains
            stringComparison: ordinalIgnoreCase
            valueType: string
            value: finance
        - attributeComparison:
            left:
              source: resource
              name: ownerId
            operator: equal
            right:
              source: subject
              name: id
        - timeWindow:
            days: [monday, tuesday, wednesday, thursday, friday]
            start: "08:00"
            end: "18:00"
            timeZone: Europe/Istanbul
        - contextAge:
            timestamp: mfa
            maximumAge: "00:15:00"
        - context:
            property: trustedDevice
            operator: equal
            valueType: boolean
            value: true

The compiled policy collection can be registered with the RuleGate engine or the ASP.NET Core integration.

ASP.NET Core applications can register a validated YAML source directly:

builder.Services
    .AddRuleGate()
    .AddYamlPolicyFile(
        "rulegate.yaml",
        options => options.ReloadOnChange = true);

Failed reloads preserve the last valid immutable policy snapshot.

The manifest supports typed scalar and collection literals, ordinal string comparison, value-less presence, null and collection-state operators, and subject, resource, context, or literal operand comparisons. It also supports explicit-time-zone schedules, bounded date-time rules, authentication and MFA age, and canonical context-property requirements.

RuleGate packages

Documentation

• Manifest guide
• Getting started
• Authorization model
• Security model
• RuleGate CLI
• Policy testing
• Policy sources and atomic reload
• Telemetry, performance, and concurrency
• Documentation index
• Detailed minimal manifest
• Document approval policy manifest

Security

Treat manifest files as security-sensitive configuration. Load policies from controlled sources, reject failed compilation, and never continue with a partial policy set. Reloadable hosts preserve the last valid complete snapshot when a candidate source fails.

Report suspected vulnerabilities through the private security reporting process.

License

RuleGate is licensed under the MIT License.

Defensive manifest limits

The manifest loader and validator fail closed for oversized or structurally excessive input. A manifest is limited to 1 MiB of source content, 4,096 policies, requirement depth 64, 4,096 nodes per policy, 1,024 children per logical requirement, and 65,536 total requirement nodes. Programmatically constructed requirement cycles are rejected before semantic validation.

YAML security profile

RuleGate manifests use a deliberately restricted YAML profile:

• a manifest file must contain valid UTF-8; an optional UTF-8 BOM is accepted;
• UTF-16, UTF-32, and malformed UTF-8 files are rejected;
• exactly one YAML document is allowed;
• anchors and aliases are rejected;
• explicit local and global YAML tags are rejected;
• duplicate mapping keys and unknown model properties are rejected;
• parser recursion and manifest resource limits remain enforced.

These restrictions avoid alias expansion, object-graph cycles introduced during deserialization, ambiguous encoding behavior, type-tag activation, and partial multi-document interpretation. Rejected inputs produce ManifestLoadCodes.InvalidYaml; they are never partially compiled into active policies.