DenySignal
DenySignal records whether a denial fact exists for a subject or scope and returns that fact at read time. Use it for account holds, moderation state, restriction flags and operator denials.
Your application can include these facts in StateMirror evidence. StateMirror accepts application-defined JSON without any Signal.
Returned facts
- Denial present or absent
- Optional reason or metadata written by your system
DenySignal runs in your environment with PostgreSQL. Reads perform a lookup without mutating state or executing side effects.
Application boundary
No denial fact does not mean permission. Your application owns identity, authorization and policy enforcement. DenySignal does not block requests or act as a firewall, gateway or abuse-prevention system.
Before a sensitive operation, query the denial fact and evaluate it with your own rules. Your application decides whether to continue, block, escalate or record an outcome.
Failure modes
- Missing or delayed writes can hide an intended denial.
- Subject or scope mismatches can return facts for the wrong entity.
- Partial writes can leave reads stale or incomplete.
- Network or database failures can prevent reads or cause timeouts.
Technical specification · Application example · Printable datasheet
Artifact v1.0.0.