com.publicdomainrelay.temp.auth.allowlist.rbacDid

{
  "id": "com.publicdomainrelay.temp.auth.allowlist.rbacDid",
  "defs": {
    "main": {
      "key": "tid",
      "type": "record",
      "record": {
        "type": "object",
        "required": [
          "protects",
          "allowed",
          "createdAt"
        ],
        "properties": {
          "allowed": {
            "type": "unknown",
            "description": "Map of label → [did, ...] entries. Lists DIDs authorized under each label."
          },
          "protects": {
            "type": "unknown",
            "description": "Map of label → { service, scope } entries. Labels are arbitrary keys (e.g. 'allowSelf'). Each value has a service id and optional scope that must match for the protection to apply."
          },
          "createdAt": {
            "type": "string",
            "format": "datetime"
          }
        }
      },
      "description": "Self-allowlist granting the record owner's DID access to their own account-scoped operations. Used by bidders and other automated actors to authorize AT Protocol writes (e.g. applyWrites) on their own repo via service-auth tokens."
    }
  },
  "$type": "com.atproto.lexicon.schema",
  "lexicon": 1
}