ManagedRole
in package
Declares that a role must exist, as part of a CONTRACT.md §27.6 manifest.
PHP's declarative idiom is the attribute, and this SDK already uses it for §11 (RequireAccess, RequireRole). §27.6 gets the same treatment: annotate a class that stands for a tenant's desired shape, and ManifestAttributeReader turns it into a ManagementManifest.
The attribute carries no behaviour. It is metadata, exactly like RequireAccess — the
reader builds the manifest, and only apply() ever writes anything.
Repeatable, because one class normally declares a whole tenant.
Attributes
- #[Attribute]
- \Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE
Table of Contents
Properties
- $description : string
- $grants : array<string|int, mixed>
- $isGlobal : bool
- $key : string
- $name : string
Methods
- __construct() : mixed
Properties
$description read-only
public
string
$description
= ''
$grants read-only
public
array<string|int, mixed>
$grants
= []
$isGlobal read-only
public
bool
$isGlobal
= false
$key read-only
public
string
$key
$name read-only
public
string
$name
Methods
__construct()
public
__construct(string $key, string $name[, string $description = '' ][, bool $isGlobal = false ][, array<string, string> $grants = [] ]) : mixed
Parameters
- $key : string
-
Manifest-local identity, referenced by ManagedGroup.
- $name : string
-
The role's name on the server.
- $description : string = ''
-
Human-readable description.
- $isGlobal : bool = false
-
Whether the role applies tenant-wide.
- $grants : array<string, string> = []
-
Permission KEY =>
allow|deny. AXIAM's RBAC is deny-override: an explicitdenybeats every allow at any depth, so it is a strong statement rather than a default a narrower allow can reverse.