Module scopes 

Canonical Soma authorization scope constants.

Single source of truth for every scope name Soma issues or checks, and for the write-implies-read satisfaction rule. Formerly split across soma-contracts’ actions.rs (READ_SCOPE/WRITE_SCOPE/DENY_SCOPE/ scopes_satisfy) and scopes.rs (ADMIN_SCOPE/has_admin_scope); merged here since they are the same invariant-value concept.

Constants

ADMIN_SCOPE

Admin scope: grants administrative actions.

DENY_SCOPE

Sentinel scope no token can hold; assigned to unknown actions to deny them.

READ_SCOPE

Read scope: grants access to read-only actions.

WRITE_SCOPE

Write scope: grants mutating actions and satisfies READ_SCOPE.

Functions

has_admin_scope

Returns true if scopes contains ADMIN_SCOPE.

scopes_satisfy

Returns true if token_scopes satisfy required. Write scope satisfies read (write includes read). Single source of truth - called from both REST and MCP enforcement paths.