Data areas and access

A Data Area gives a human name to a bounded Zenoh key-expression region. An Access Grant combines that area with a known identity and an action.

Allow the weather dashboard to subscribe to Vilnius sensors.

That sentence captures the operator’s intent. Scout then validates the scope and compiles a native Zenoh ACL for enforcement.

Scope comes first

A Data Area must remain inside the selected Branch prefix. A child cannot create an area beside or above its assigned namespace. The reserved management namespace is separate from data access and cannot be granted to a data-plane identity.

For a child, the parent delegation ceiling can narrow both namespace and actions. The editor shows those limits before submission: an action or path outside the ceiling stays visible but locked and names the delegating source.

Default-deny enforcement

The compiler produces a default-deny result for one Branch-scoped Publish or Subscribe Access Grant. Before applying, the UI lets you review the plain-language effect and reveal the native ACL output as advanced evidence.

Applying the Access Grant changes Router configuration, so the same restart and last-good considerations as other configuration work apply.

Crossing a Branch boundary

A peer-Branch subject adds explicit direction:

• Leaving — the peer receives from this enforcing Branch;
• Entering — this Branch receives from the peer.

The effect sentence names both Branches, the Data Area, and the direction. Each Controller records and enforces its own side; creating one side does not claim the remote side is already active.

Current boundary

Production-boundary tests render and apply real Branch Router configuration, then check that an in-area sample is delivered and an adjacent out-of-scope sample remains silent. Cross-Branch intent, delegated ceilings, access simulation, and flow explanation are implemented in scoped surfaces; each Branch still reports only the side it can verify.

Scout does not capture payloads, so an enabled cross-Branch Grant alone is not proof that a sample traversed a Branch boundary. The product walkthrough requires allowed delivery and denied-neighbor silence through an enrolled Client fixture.