/**
 * Security Middleware
 *
 * Capability-based access control. Validates that the agent has permission
 * to perform the requested operation on the target entity.
 */
import type { KernelMiddleware } from './middleware.js';
export type Permission = 'read' | 'create' | 'update' | 'delete' | 'link' | 'unlink' | 'admin';
export interface Capability {
    /** What the capability applies to (entity ID, type, or '*' for all) */
    resource: string;
    /** Permissions granted */
    permissions: Permission[];
}
export interface SecurityMiddlewareConfig {
    /** Agent ID to capabilities map */
    capabilities: Map<string, Capability[]>;
    /** Default capabilities for agents not in the map */
    defaultCapabilities?: Capability[];
    /** If true, blocks operations without explicit grants. If false, allows by default. */
    strict?: boolean;
}
export declare function createSecurityMiddleware(config: SecurityMiddlewareConfig): KernelMiddleware;
//# sourceMappingURL=security-middleware.d.ts.map