Torusguard Authorize

TorusGuard Authorize — Legal Scope & Safety Gate Registration

Objective

Define and validate legal runtime authorization boundaries, verify target ownership, enforce maximum rate limits, and persist a cryptographically auditable .torusguard/config/scope.json.

Execution Steps

1. Capture Scope Parameters: Collect target host URL, allowed path prefixes, forbidden prefixes, and session TTL.
2. Validate Environment: Assert target is local (localhost, 127.0.0.1) or staging (*.staging.*). Block production targets without explicit override.
3. Verify Host Ownership: Confirm ownership token or local process socket binding.
4. Invoke Safety Gate:

   python .torusguard/scripts/safety_gate.py check --url <target_url>
   

5. Handle CLI Failures: If safety_gate.py fails or is unavailable, YOU must manually verify the safety invariants and generate the JSON structure below.
6. Write Scope Record: Persist authorized targets, rate limits, and expiration timestamp into .torusguard/config/scope.json.
7. Validate Schema: Confirm scope.json adheres to auth-boundary.schema.json.

Safety Constraints

• Never authorize wildcard hosts (*) or third-party domains.
• State-changing destructive actions (DELETE, bulk drops) are disabled by default.
• Set strict TTL (default 4 hours, maximum 24 hours).

Output Format

🔒 [TorusGuard] Target Scope Authorized (AI Assisted)
- Target Host: <Host URL> | Environment: <Local / Staging>
- Allowed Paths: <Prefixes> | Rate Limit: <Max Req/sec>
- Expiration TTL: <Timestamp>
- Scope File: `.torusguard/config/scope.json`
Next: Run `/torusguard web-validate` to begin safe runtime probing.