Package com.tnsai.annotations

Annotation Interface Security

@Documented @Retention(RUNTIME) @Target({METHOD,TYPE}) public @interface Security
Configures security policies for actions and roles.

This annotation provides declarative security configuration including approval requirements, audit logging, data sensitivity, and access control.

Usage on Method


 @ActionSpec(type = ActionType.LOCAL, description = "Delete user account")
 @Security(
     approvalRequired = true,
     approvalReason = "Permanent data deletion",
     audit = AuditLevel.DETAILED,
     sensitive = true
 )
 public void deleteUser(String userId) { ... }

Usage on Type


 @Security(
     audit = AuditLevel.BASIC,
     allowedCallers = {"admin-agent", "supervisor-agent"}
 )
 public class AdminRole extends Role { ... }
Author:
TnsAI Team
See Also:

  • Element Details

    • approvalRequired

      boolean approvalRequired
      Whether human approval is required before execution.
      Returns:
      true if approval required
      Default:
      false

    • approvalReason

      String approvalReason
      Reason for requiring approval.

      Displayed to the approver.

      Returns:
      approval reason
      Default:
      ""

    • audit

      Security.AuditLevel audit
      Audit logging level.
      Returns:
      audit level
      Default:
      NONE

    • sensitive

      boolean sensitive
      Whether action handles sensitive data.

      Sensitive data is masked in logs and traces.

      Returns:
      true if sensitive
      Default:
      false

    • maskFields

      String[] maskFields
      Fields to mask in logs (for sensitive data).
      Returns:
      field names to mask
      Default:
      {}

    • allowedCallers

      String[] allowedCallers
      Agent IDs allowed to call this action/role.

      Empty means all agents allowed.

      Returns:
      allowed caller IDs
      Default:
      {}

    • allowedRoles

      String[] allowedRoles
      Roles allowed to call this action.

      Empty means all roles allowed.

      Returns:
      allowed role names
      Default:
      {}

    • requiredPermissions

      String[] requiredPermissions
      Required permissions for this action.
      Returns:
      required permission names
      Default:
      {}

    • encryptParams

      boolean encryptParams
      Whether to encrypt action parameters in transit.
      Returns:
      true to encrypt
      Default:
      false

    • encryptResult

      boolean encryptResult
      Whether to encrypt action result in transit.
      Returns:
      true to encrypt
      Default:
      false

    • securityTimeout

      int securityTimeout
      Maximum execution time before automatic abort (security timeout).

      0 means no security timeout.

      Returns:
      timeout in milliseconds
      Default:
      0

    • idempotent

      boolean idempotent
      Whether action can be replayed (idempotent).

      Non-idempotent actions get replay protection.

      Returns:
      true if idempotent
      Default:
      false