Driven ports (service provider interfaces) for the Firefly security platform; providers implement these as adapters

Framework-neutral security engine: authority mapping, the @Secure authorization evaluator, the embedded policy decision point, introspection caching and principal projection

Cerbos adapter implementing PolicyDecisionPort for externalized ABAC via the Cerbos check API, fail-closed

Open Policy Agent (OPA/Rego) adapter implementing PolicyDecisionPort for externalized ABAC, fail-closed

OpenFGA (Zanzibar-style ReBAC) adapter implementing RelationshipPort, fail-closed

R2DBC/relational-database adapter for security data repositories: token revocation list and opaque-introspection cache (no external cache server required)

HashiCorp Vault adapter implementing SecretsPort over the KV v2 engine, so credentials live in Vault rather than YAML

Optional servlet-only OAuth2/OIDC Authorization Server (Spring Authorization Server) with JWKS sourced from the framework KeyManagementPort. Deployed separately from reactive resource servers.

Test fixtures for the security platform: principal factories and a configurable fake PolicyDecisionPort