Role-based access control that fails closed and explains itself.
Most authz answers "no" without saying why, so every denial becomes a debugging session — and the ones that fail OPEN never announce themselves at all.
pip install awbac
Gate one endpoint and read the explanation it gives for a denial.
Pairing is composition, never dependency — awbac installs and runs on its own.
Every brick below is live, drawn from that repository's own published manifest.