# `Jido.Messaging.Security`
[🔗](https://github.com/agentjido/jido_messaging/blob/v1.0.0/lib/jido_messaging/security.ex#L1)

Centralized security boundary for inbound verification and outbound sanitization.

Security checks are bounded with timeout budgets, failures are classified, and
explicit policy determines whether failures deny or degrade.

# `classification`

```elixir
@type classification() :: :allow | :deny | :retry | :degrade
```

Security classification for decisions and failures.

# `decision`

```elixir
@type decision() :: %{
  :stage => stage(),
  :classification => classification(),
  :outcome => atom(),
  :action => atom(),
  :policy => atom(),
  :channel => module(),
  :adapter => module(),
  :mode => mode(),
  :elapsed_ms => non_neg_integer(),
  optional(:reason) => term(),
  optional(:description) => String.t(),
  optional(:changed) => boolean(),
  optional(:fallback) => boolean()
}
```

Security decision metadata.

# `mode`

```elixir
@type mode() :: :permissive | :strict
```

Security enforcement mode.

# `sanitize_failure_policy`

```elixir
@type sanitize_failure_policy() :: :allow_original | :deny
```

Policy for sanitize failures.

# `sanitize_result`

```elixir
@type sanitize_result() ::
  {:ok, term(), %{decision: decision(), metadata: map()}}
  | {:error, security_denial()}
```

Successful sanitize result envelope.

# `security_denial`

```elixir
@type security_denial() :: {:security_denied, stage(), atom() | tuple(), String.t()}
```

Typed security denial returned to ingest/outbound callers.

# `stage`

```elixir
@type stage() :: :verify | :sanitize
```

Security boundary stage.

# `verify_failure_policy`

```elixir
@type verify_failure_policy() :: :allow | :deny
```

Policy for verify failures.

# `verify_result`

```elixir
@type verify_result() ::
  {:ok, %{decision: decision(), metadata: map()}} | {:error, security_denial()}
```

Successful verify result envelope.

# `sanitize_outbound`

```elixir
@callback sanitize_outbound(
  channel_module :: module(),
  outbound :: term(),
  opts :: keyword()
) ::
  {:ok, term()} | {:ok, term(), map()} | {:error, term()}
```

# `verify_sender`

```elixir
@callback verify_sender(
  channel_module :: module(),
  incoming_message :: map(),
  raw_payload :: map(),
  opts :: keyword()
) :: :ok | {:ok, map()} | {:deny, atom(), String.t()} | {:error, term()}
```

# `config`

```elixir
@spec config(
  module(),
  keyword()
) :: keyword()
```

Resolve runtime security config for an instance module.

Config precedence (lowest to highest):

  1. Defaults
  2. `config :jido_messaging, :security, ...`
  3. `config <instance_module>, :security, ...`
  4. Runtime overrides passed as `security: [...]` in opts

# `sanitize_outbound`

```elixir
@spec sanitize_outbound(module(), module(), term(), keyword()) :: sanitize_result()
```

Sanitize outbound payload through the configured security adapter.

# `verify_sender`

```elixir
@spec verify_sender(module(), module(), map(), map(), keyword()) :: verify_result()
```

Verify an inbound sender through the configured security adapter.

---

*Consult [api-reference.md](api-reference.md) for complete listing*