wb.security

addPolicy(policy: Omit<AccessPolicy, 'id'>): Promise<PolicyId>;

Add a new access policy. Rust enforces capability attenuation: the caller's effective workbook level must be >= the granted level. @returns The assigned PolicyId

removePolicy(id: PolicyId): Promise<void>;

Remove a policy by ID. Idempotent at the store layer.

updatePolicy(id: PolicyId, updates: Partial<Omit<AccessPolicy, 'id'>>): Promise<void>;

Update fields on an existing policy. Attenuation re-runs when `level` is patched.

getPolicies(): Promise<AccessPolicy[]>;

Get all policies currently on the document, in stable id-sorted order.

getEffectiveAccess(principal: AccessPrincipal, target: AccessTarget): Promise<AccessLevel>;

Get the effective access level for a principal at a target.

explainAccess(principal: AccessPrincipal, target: AccessTarget): Promise<AccessExplanation>;

Explain why a principal has a given access level at a target. Returns the winning policy, reason, candidates, and any warnings.

applyTemplate(templateId: string, options: Record<string, unknown>): Promise<PolicyId[]>;

Apply a named template, generating policies. The `templateId` is the Rust tagged-enum variant name (e.g. `protect_workbook`, `protect_sheet`, `agent_structure`); `options` merges into the wire payload under the same keys the Rust `Template` variant expects. @returns The PolicyIds of the generated policies.

removeTemplate(templateId: string): Promise<void>;

Remove all policies generated by a template.