The Condition Seam: Attributes Without a Rules Engine

​

Declaring

const catalog = defineCatalog({
  namespaces: ["exp"],
  permissions: {
    "exp.claims.read": {},
    "exp.claims.approve_claim": {
      requiresCondition: true,   // holding it is necessary, not sufficient
      description: "Approve an expense claim within the approver's limit",
    },
  },
});

​

Gating

export async function approveClaim(claimId: string) {
  "use server";
  const claim = await db.claim.findUniqueOrThrow({ where: { id: claimId } });
  const limit = await approvalLimitOf(session.userId);
  await alfiz.require(session.principal, "exp.claims.approve_claim", claim.scope, {
    condition: () => claim.amount <= limit,
  });
  // …
}

• A gate without the condition throws MissingConditionError, a programming error on the same footing as UnknownPermissionError: map it to 500, never 403. The caller forgot the predicate; the principal was not denied.
• The condition runs only after the rows allow. A principal the rows already deny never pays for (or triggers) your predicate.
• A false condition is a deny, observed as one in metrics, with the rows that would have allowed kept for attribution.
• Async is fine on the async surfaces (can, require, the session). On the synchronous snapshot the predicate must return a plain boolean, so resolve your data before the check or use client.can. A Promise there throws.
• Visibility is unaffected. canAny and holds ignore the declaration: a button may exist because authority exists; the gate still decides. Keys without the declaration may still pass a condition voluntarily.
• Conditions never cross a wire. The /v1/check operation answers requiresCondition keys with an error rather than a half-checked yes, because a predicate over resource state is meaningful only where the resource lives.

​

Verified in CI

app/actions.ts:12 error missing-condition: "exp.claims.approve_claim" is declared
`requiresCondition: true`, so the gate must pass `{ condition: () => … }` …

​

What this is not