/** What a policy is asked to decide: this subject, doing this action, optionally to this resource. */
export interface AuthorizationRequest<Subject = unknown, Resource = unknown> {
    readonly subject: Subject;
    readonly action: string;
    readonly resource?: Resource;
}
export type Authorizer<Subject = unknown, Resource = unknown> = (request: AuthorizationRequest<Subject, Resource>) => boolean | Promise<boolean>;
/** Evaluate a policy, failing closed for any non-true result. */
export declare function isAuthorized<Subject, Resource>(authorizer: Authorizer<Subject, Resource>, request: AuthorizationRequest<Subject, Resource>): Promise<boolean>;
/** Require an application/data-layer policy to allow an action. A denied request throws a plain
 * `status(403)` render - the same control-flow signal a guard throws, on the same rendering lane as a
 * returned one, so the denial never builds a `Response`. Like the guards, it throws because it is
 * called for effect from inside the work it protects; where the caller can return, return
 * `status(403, ...)` instead. */
export declare function requireAuthorization<Subject, Resource>(authorizer: Authorizer<Subject, Resource>, request: AuthorizationRequest<Subject, Resource>): Promise<void>;
//# sourceMappingURL=authorization.d.ts.map