com.publicdomainrelay.temp.auth.allowlist.rbacDid

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Self-allowlist granting the record owner's DID access to their own account-scoped operations. Used by bidders and other automated actors to authorize AT Protocol writes (e.g. applyWrites) on their own repo via service-auth tokens.",
      "key": "tid",
      "record": {
        "properties": {
          "allowed": {
            "description": "Map of label → [did, ...] entries. Lists DIDs authorized under each label.",
            "type": "unknown"
          },
          "createdAt": {
            "format": "datetime",
            "type": "string"
          },
          "protects": {
            "description": "Map of label → { service, scope } entries. Labels are arbitrary keys (e.g. 'allowSelf'). Each value has a service id and optional scope that must match for the protection to apply.",
            "type": "unknown"
          }
        },
        "required": [
          "protects",
          "allowed",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "id": "com.publicdomainrelay.temp.auth.allowlist.rbacDid",
  "lexicon": 1
}