State-Reflective Authorization Path

The problem

It is difficult to ensure that a user is allowed to perform a sequence of actions based on both their specific job role and the current status of a process.

What it does

It checks a list of actions to see if they are allowed by looking at the user's permissions and the current step of the application.

Why it matters

It ensures that users can only move through a process in a way that is both authorized and logically correct.

Validation

It was run inside an isolated container with no network access. This is the exact command and the real output it produced — captured process output, not written by a model.

$ python3 auth_tool.py
The action sequence is not permitted or contains invalid transitions.
All actions in the sequence are permitted and valid transitions.

A screenshot of that run.

A clean run proves this does what is shown above, in a CPU-only sandbox. It is a small research demo — not a production tool, and nothing here was published anywhere.

The code

All of it — 74 lines, one file, standard library only.

from dataclasses import dataclass, field
from typing import Optional, List

@dataclass
class Role:
    name: str
    parent: Optional['Role'] = None
    permissions: set = field(default_factory=set)

@dataclass
class State:
    name: str
    transitions = {}  # action -> (next_state, required_permission)
    permissions = {}  # action -> required_permission

    def add_transition(self, action: str, next_state: str, required_permission: str):
        self.transitions[action] = (next_state, required_permission)

@dataclass
class StateMachine:
    initial_state: str
    states: dict = field(default_factory=dict)

    def add_state(self, state: State):
        self.states[state.name] = state

    def validate_action_sequence(self, rbac, user_role: str, actions: List[str]) -> bool:
    
        current_state = self.states.get(self.initial_state)
        if not current_state:
            return False

        for action in actions:
            transition = current_state.transitions.get(action)
            if not transition:
                return False

            next_state, required_permission = transition
            if not rbac.has_permission(user_role, required_permission):
                return False

            current_state = self.states.get(next_state)
            if not current_state:
                return False

        return True

# Example configuration
from state_reflective_auth import RBAC
rbac = RBAC()
admin_role = Role("admin")
admin_role.permissions.add("admin_all")
user_role = Role("user", parent=admin_role)
reader_role = Role("reader", parent=user_role)
reader_role.permissions.add("read_data")
rbac.add_role(admin_role)
rbac.add_role(user_role)
rbac.add_role(reader_role)

initial = State("initial")
reading = State("reading")
initial.add_transition("read", "reading", "read_data")

# Test sequence
actions = ["read"]
user_role_name = "reader"
sm = StateMachine("initial")
sm.add_state(initial)
sm.add_state(reading)

if sm.validate_action_sequence(rbac, user_role_name, actions):
    print("All actions in the sequence are permitted and valid transitions.")
else:
    print("The action sequence is not permitted or contains invalid transitions.")