Reference

Function Reference

Every morbac helper function alongside is_allowed: org traversal, roles, cache, audit, config.

morbac.is_allowed is the front door, but it is built on a family of helper functions you can call directly, whether to compose your own checks, to debug a decision, or to drive an admin UI. Every function lives in the morbac schema.

Decision

Function	Returns	Purpose
`is_allowed(user, org, activity, view)`	boolean	The cached decision. The one you call in normal use.
`is_allowed_nocache(user, org, activity, view)`	boolean	The same decision computed from scratch, for debugging.
`rls_check(activity, view, row_org, row_user)`	boolean	The row-level-security entry point; reads session context. See row-level security.

Organizations

Function	Returns	Purpose
`get_org_ancestors(org)`	rows of (org_id, depth)	The org and every ancestor.
`get_org_descendants(org)`	rows of (org_id, depth)	The org and every descendant.
`get_org_scope(org, scope, max_depth)`	rows of (org_id, depth)	A named slice of the tree: `self`, `children`, `descendants`, `subtree`, `parent`, `ancestors`, `lineage`, `root`.
`org_in_scope(asked, rule_org, scope)`	boolean	Whether a rule at `rule_org` with `scope` covers `asked`.

Roles

Function	Returns	Purpose
`get_comprehensive_roles(user, org)`	rows of (role_id, source, depth)	Every effective role: direct, delegated, derived, inherited.
`get_effective_roles(user, org)`	rows of (role_id, depth)	Direct plus inherited roles.
`get_inherited_roles(role)`	role ids	Roles a given role inherits through the hierarchy.
`user_roles_in_org(user, org)`	role ids	The user's directly assigned roles in an org.
`user_has_role(user, org, role_name)`	boolean	A quick membership check.
`assign_role(user, role, org)`	void	Assign a role, enforcing separation of duty and cardinality.
`revoke_role(user, role, org)`	void	Remove a role assignment.

Activities and views

Function	Returns	Purpose
`get_effective_activities(activity)`	activity names	The activity plus every senior activity that implies it.
`get_effective_views(view)`	view names	The view plus its hierarchy expansion.

Contexts, obligations, recommendations

Function	Returns	Purpose
`eval_context(context_id)`	boolean	Evaluate a context's predicate now.
`pending_obligations(user, org)`	rows	Duties the user currently owes (obligations recipe).
`pending_recommendations(user, org)`	rows	Advisory actions not voided by a prohibition or obligation.

Session context (RLS)

Function	Returns	Purpose
`current_user_id()`	uuid	The acting user from the session.
`current_org_id()`	uuid	The single org in scope, if set.
`current_org_ids()`	uuid[]	The org list in scope, if set.
`current_target_user_id()`	uuid	The per-user row filter, if set.
`get_user_orgs(user)`	org ids	Every org the user holds a role in.

Cache and audit

Function	Returns	Purpose
`invalidate_cache(user, org)`	void	Flush cached decisions for a user/org (both optional).
`invalidate_all_cache()`	void	Flush the whole decision cache.
`cleanup_auth_cache()`	void	Delete expired cache rows (housekeeping).
`enable_audit(table)` / `disable_audit(table)`	void	Attach or detach the audit trigger on a table.

Constraints and configuration

Function	Returns	Purpose
`check_sod_violation(user, role, org)`	boolean	Whether assigning a role would break separation of duty.
`check_cardinality_violation(role, adding)`	boolean	Whether a role's user cap would be exceeded.
`get_config(key)` / `set_config(key, value)`	text / void	Read or change runtime settings such as `cache_ttl_seconds` and `schema_version`.

All of these are plain SQL functions: call them from any language, or from psql, exactly like is_allowed.