Product-agnostic security domain model and driving ports (use-cases) for the Firefly security platform

Driven ports (service provider interfaces) for the Firefly security platform; providers implement these as adapters

Framework-neutral security engine: authority mapping, the @Secure authorization evaluator, the embedded policy decision point, introspection caching and principal projection

Reactive Spring Security binding: principal projection, ReactiveSecurityContext access, and the URL policy enforcement point

Cerbos adapter implementing PolicyDecisionPort for externalized ABAC via the Cerbos check API, fail-closed

Open Policy Agent (OPA/Rego) adapter implementing PolicyDecisionPort for externalized ABAC, fail-closed

OpenFGA (Zanzibar-style ReBAC) adapter implementing RelationshipPort, fail-closed

R2DBC/relational-database adapter for security data repositories: token revocation list and opaque-introspection cache (no external cache server required)

HashiCorp Vault adapter implementing SecretsPort over the KV v2 engine, so credentials live in Vault rather than YAML

Test fixtures for the security platform: principal factories and a configurable fake PolicyDecisionPort