tree 3a0c39f2e7f47ba92c7c79f1b0967b19bacff503
parent 3c7d0a79628f7ad65e8e682abebef9b966fd171c
author Asim Shankar <ashankar@google.com> 1452310317 -0800
committer Asim Shankar <ashankar@google.com> 1452310321 -0800

security/access: Add an "access tag" caveat.

This commit introduces a Caveat implementation that can be used to
restrict methods invokable by a principal based on the tags on the
method being invoked.

My first intented use of this is for the "debug browse" tool,
wherein one user can delegate debugging of their server to
another - restricting the delegate so that it can only invoke
methods with the Debug or Resolve label - and thus not mess
with state of the server being debugged.

MultiPart: 1/2

Change-Id: I7605c230792ac4b0ecd0e42e54becc286b2af9d1