Resource Access Lock
A switch in front of a resource with three positions: open allows everything, read-only allows the actions that read, and locked allows nothing. An incident responder flips it without a deploy, and every flip and every refusal is audited.
The read set is fixed: read, list, get, query and read-only. An action outside it is a write as far as the lock is concerned, so a name the caller invents is refused under read-only rather than allowed by a rule that never heard of it.
b.resourceAccessLock.create(opts) #
{
resource: string, // what the lock is over; required, non-empty
startMode: string, // "open" (default), "read-only" or "locked"
audit: boolean, // default true
}Open a lock over one named resource. The handle carries resource, mode(), set(mode, ctx?), permits(action) and assertPermits(action, ctx?).
permits answers the question; assertPermits answers it and throws resource-access-lock/refused when the answer is no, so a caller that forgets to read the boolean still stops. Both take the action by name, and only read, list, get, query and read-only count as reads.
set audits the move with the actor and reason the caller passes, and assertPermits audits each refusal, so a timeline shows who narrowed a resource and what was turned away while it was narrowed.
Opening the lock throws resource-access-lock/no-resource when resource is absent or empty, and resource-access-lock/bad-start-mode when startMode is not one of the three modes above.
var b = require("@blamejs/core");
var lock = b.resourceAccessLock.create({ resource: "payouts" });
lock.set("read-only", { actor: "soc-on-call", reason: "IR-2026-0042" });
lock.permits("list"); // → true
lock.permits("transfer"); // → false
lock.assertPermits("transfer");
// throws ResourceAccessLockError "resource-access-lock/refused"