Shared test utilities and architecture rules; used with test scope only

Contract between the server and service type plugins: the service type definition model, the provider SPI and the plugin descriptor. Depends on nothing but JSpecify and is versioned on its own (ApiVersion).

What every agent in a protected system shares: downloads and checks the signed policy snapshots of its service, keeps the last one on disk, decides access with the policy engine and ships access events; runs on Java 8 with the engine, ...

Framework-free building blocks: null-safe helpers, error codes and pagination models

Database-portable persistence foundation: IDs, base entity, naming rules and query helpers

Append-only audit trail of security events

Tenants, user accounts, password hashing and first-run setup

The resource catalog (applications, menus, pages, buttons, APIs), roles and grants

Loads service type plugins: built-in ones from the classpath, external ones from the plugins directory, each in its own class loader

The OAuth 2.1 and OpenID Connect authorization server for applications of the catalog: their clients, the authorizations and tokens it issues, kept as hashes, and its rotating signing keys

Decides access requests against policies; embedded by the agents in the systems GrantForge protects, so it runs on Java 8 and depends on nothing