# `Wardrik.Statement`

Allows actions on the resources its patterns match, like an IAM statement.

    Wardrik.Statement.new(roles: [:reader, :messenger], resources: ["acme/agent/*"])
    Wardrik.Statement.new(actions: ["agent.*"], resources: ["acme/@jon/*"])

In a pattern, `*` matches any run of characters, including `/`. `?` matches one character.

## Roles

A role is a named set of actions:

| Role | Actions |
| --- | --- |
| `:reader` | `agent.read`, `agent.events`, `connection.read`, `mcp_server.read`, `ceiling.read` |
| `:messenger` | `agent.ask`, `agent.cancel`, `agent.clear` |
| `:approver` | `agent.decide` |
| `:definer` | `agent.define`, `agent.spawn`, `agent.stop`, `agent.forget`, `connection.connect`, `mcp_server.add` |
| `:worker` | `agent.serve`, offering tools to the agents it covers |
| `:owner` | every action |

# `t`

```elixir
@type t() :: %Wardrik.Statement{actions: [String.t()], resources: [String.t()]}
```

# `from_json`

```elixir
@spec from_json(map()) :: t()
```

Builds a statement from the protocol's JSON.

# `new`

```elixir
@spec new(keyword()) :: t()
```

Builds a statement.

    Wardrik.Statement.new(roles: [:reader], actions: ["agent.ask"], resources: ["acme/agent/*"])

## Options

  * `:resources` - patterns of the resources it covers.
  * `:actions` - actions it allows. `[]` unless set.
  * `:roles` - roles whose actions it allows too. `[]` unless set.

Raises `ArgumentError` for an unknown option, and `KeyError` for an unknown role.

# `role`

```elixir
@spec role(String.t()) :: {:ok, atom()} | :error
```

Returns `{:ok, role}` for a role's name, as `:reader` for `"reader"`, or `:error`.

# `to_json`

```elixir
@spec to_json(t()) :: map()
```

Returns the statement as the protocol's JSON.

---

*Consult [api-reference.md](api-reference.md) for complete listing*