dogwood.enforcement

SDK-level enforcement modes for Dogwood authorization decisions.

The Rust Dogwood core evaluates policy and returns a policy decision. This module adds Python SDK rollout behavior around that decision: enforce denials, or run in log-only mode and report what would have happened.

Behavior matrix:

Dogwood decision	SDK mode	Enforcement result
Allow	enforce	allowed=True
Deny	enforce	allowed=False
Allow	log_only	allowed=True
Deny	log_only	allowed=True, would_have_denied=True

class dogwood.enforcement.EnforcementResult

Effective SDK decision for an evaluated Dogwood event or request.

decision is the raw Dogwood policy result, usually "Allow" or "Deny". allowed is the effective SDK outcome after applying mode. In log_only mode, a Dogwood denial produces allowed=True and would_have_denied=True.

decision: str | None

mode: Literal['enforce', 'log_only']

allowed: bool

policy_allowed: bool | None

would_have_denied: bool

response: Any = None

denied()

Return true when the effective SDK outcome blocks the operation.

Return type:

bool

class dogwood.enforcement.PolicyEnforcer

Apply enforce or log_only behavior to Dogwood decisions.

Wrap either the Python fallback Authorizer or native authorizer-like objects. The wrapped authorizer still performs the Dogwood policy evaluation; this class only decides how that result affects the caller.

authorize(event)

Authorize an SDK Event using authorizer.is_authorized.

Parameters:

event (Any)

Return type:

EnforcementResult

is_authorized(event)

Alias for authorize() for Authorizer-like usage.

Parameters:

event (Any)

Return type:

EnforcementResult

authorize_request(action, principal, resource, input)

Authorize a native-style request using authorize_request.

Parameters:

• action (str)

• principal (str)

• resource (str)

• input (dict[str, Any])

Return type:

EnforcementResult

dogwood.enforcement.apply_enforcement(response, mode='enforce')

Return the effective SDK outcome for a raw Dogwood response.

Parameters:

• response (Any)

• mode (str)

Return type:

EnforcementResult

dogwood.enforcement.decision_text(response)

Extract Allow or Deny text from common Dogwood response shapes.

Parameters:

response (Any)

Return type:

str | None

dogwood.enforcement.is_allowed_decision(response)

Return true when a raw Dogwood response or decision is Allow.

Parameters:

response (Any)

Return type:

bool

dogwood.enforcement.is_enforced(mode)

Return true when mode enforces Dogwood denials.

Parameters:

mode (str)

Return type:

bool

dogwood.enforcement.normalize_mode(mode)

Normalize SDK enforcement mode names.

Accepts Python-style lowercase values and AWS-style uppercase values: "enforce", "log_only", "ENFORCE", and "LOG_ONLY".

Parameters:

mode (str)

Return type:

Literal[‘enforce’, ‘log_only’]