RuleGate Roadmap

This document records the delivered path through RuleGate 1.0 and outlines post-stable repository initiatives and versioned product development. Future scope may change as security boundaries, package structure, sample feedback, and package-only consumer feedback evolve.

Product direction

RuleGate is a local-first, embedded, provider-independent authorization framework for .NET and Angular applications. It evaluates application-specific authorization rules from roles, permissions, claims, and attributes supplied by the host application or its identity provider.

RuleGate does not replace authentication, Keycloak, ASP.NET Core Identity, IdentityServer, an application user store, or another identity provider. Provider-specific integrations remain optional adapters around the provider-independent authorization engine.

RuleGate 1.0 preserves five product properties:

• local-first evaluation;
• default-deny and fail-closed behavior;
• provider-independent core packages;
• testable policies and deterministic tooling;
• safe diagnostics that explain structure without exposing sensitive values.

Current status

Capability	Status
Authorization engine	✅ Available
Permission- and role-based authorization	✅ Available
Logical all, any, and not requirements	✅ Available
Typed scalar attribute comparison	✅ Available
Subject, resource, and context attributes	✅ Available
YAML manifest compilation	✅ Available
ASP.NET Core integration	✅ Available
Authorization diagnostics and logging	✅ Available
CLI validation and deterministic generation	✅ Available
Angular SDK and TypeScript generation	✅ Available
Optional Keycloak helpers	✅ Available
Advanced Attribute Operators	✅ Available
Attribute-to-Attribute Comparison	✅ Available
First-Class Time and Context Policies	✅ Available
ASP.NET Core Enrichment Pipeline	✅ Available
Official Reference Applications	✅ Available
Policy Testing CLI	✅ Available
Explain and Lint	✅ Available
Policy Sources and Atomic Reload	✅ Available
OpenTelemetry, Benchmarks, and Concurrency	✅ Available
.NET and Angular Compatibility Track	✅ Available
API Freeze and Security Hardening	✅ Available
Stable Release	✅ Available
Book-Style Documentation and GitHub Wiki	✅ Available
Multi-Domain and Multi-Stack Sample Portfolio	🚧 Active
Native Java Package Family	⏳ Planned
Native PHP Package Family	⏳ Planned
React Integration	⏳ Planned
Vue Integration	⏳ Planned

The latest stable RuleGate NuGet release is 1.0.0. The three-package npm family is also published at 1.0.0 for this coordinated stable release. Official Reference Applications, Policy Testing, Explain and Lint, Policy Sources and Atomic Reload, OpenTelemetry, Benchmarks and Concurrency, and the compatibility track are available. API Freeze and Security Hardening are delivered in 1.0.0-rc.1; the stable 1.0.0 milestone is complete.

All NuGet packages share one version and are published together for every NuGet release, including packages without code changes. npm packages are versioned independently from NuGet and remain aligned within the npm package family.

NuGet and npm release numbers may normally differ from each other. The stable RuleGate 1.0 milestone is intentionally coordinated: all six NuGet packages and all three npm packages must be published as exactly 1.0.0.

Current platform support

The repository package and consumer matrix verifies:

Package family	Verified platform
RuleGate portable libraries	.NET Standard 2.0, .NET 8, .NET 9, and .NET 10
RuleGate ASP.NET Core integrations	.NET Core 3.1 and .NET 5 through .NET 10
RuleGate CLI	.NET 8, .NET 9, and .NET 10
Modern Angular adapter	Angular 20 through Angular 22
Legacy Angular adapter	Angular 12 through Angular 19
Framework-independent frontend client	Angular 9 through Angular 22 consumers

The stable 1.0.0 NuGet and npm package families preserve this expanded compatibility matrix after release-candidate API, security, reproducibility, and package-only consumer gates.

Support levels are:

• current: supported by the framework vendor and exercised in RuleGate CI;
• legacy-tested: no longer vendor-supported, but verified by RuleGate package-only consumers;
• unsupported: below .NET Core 3.1 or Angular 9, or not covered by either verified support level.

RuleGate cannot extend vendor security support for end-of-life runtimes. Legacy verification describes compatibility only.

Published releases

0.1.0-preview.1 — Authorization Core Foundation

• Public authorization contracts
• Policy and requirement definitions
• Permission and role requirements
• Logical requirements
• Default-deny and fail-closed evaluation
• In-memory policy provider
• YAML manifest foundation

0.2.0-preview.1 — ASP.NET Core Integration Foundation

• Dependency injection registration
• ClaimsPrincipal subject mapping
• Resource-based authorization
• Dynamic RuleGate policy names
• Minimal API integration
• Controller and action authorization
• Package-only consumer verification

0.2.0-preview.2 — Advanced Authorization and Diagnostics

• Subject, resource, and context attribute requirements
• Typed scalar comparison
• Nested manifest attribute requirements
• Authorization diagnostics contracts
• Structured ASP.NET Core logging
• Generic RuleGate HTTP 401 and 403 problem responses
• Multi-targeting for .NET 8, .NET 9, and .NET 10

0.3.0-preview.1 — CLI and Manifest Validation

• Installable Fotbiler.RuleGate.Cli .NET tool
• Default and explicit manifest-file validation
• Human-readable and JSON output
• Stable process exit codes
• Fail-closed manifest compilation and structured errors
• Package-only CLI installation and execution smoke tests
• RuleGate CLI guide

0.3.0-preview.2 — Code Generation

• Manifest-derived C# policy, resource-type, and action constants
• Deterministic output and atomic generated-file replacement
• Byte-exact stale-output detection through --check
• Identifier, namespace, and collision diagnostics
• Generated-code verification on .NET 8, .NET 9, and .NET 10
• C# code-generation guide

0.4.0-preview.1 — Angular SDK Foundation

• Signal-backed authorization client and public TypeScript models
• Permission and policy route guards
• Standalone structural authorization directive
• Generated string-constant consumption
• Angular Package Format build for @fotbiler/rulegate-angular
• Package-only npm tarball consumer verification
• Angular SDK guide

0.4.0-preview.2 — Angular Developer Experience

• Declarative route authorization metadata
• Disabled-state and template composition helpers
• Framework-aware denied-navigation handling
• TypeScript generation and backend identifier alignment
• Angular examples and integration consumers

0.5.0-preview.1 — Keycloak Helpers

• Realm-, client-, and composite-role mapping
• Claim normalization and RuleGate subject creation
• Optional Angular Keycloak secondary entrypoint
• Package-only npm and NuGet consumer verification
• Keycloak integration guide

0.5.0-preview.2 — NuGet Version Alignment

• One synchronized version for all RuleGate NuGet packages
• Aligned package-to-package dependency versions
• Complete six-package NuGet publishing and verification
• Standardized NuGet package README product naming

0.6.0-preview.1 — Advanced Attribute Operators

• String contains, startsWith, and endsWith operators
• Explicit ordinal case-sensitive and case-insensitive behavior
• Collection membership, set-intersection, and empty-state operators
• Attribute presence and null-state operators
• Homogeneous collection validation with a 256-element limit
• Defined missing-versus-null semantics and fail-closed type handling

0.6.0-preview.2 — Attribute-to-Attribute Comparison

• Subject, resource, context, and literal operands
• Ownership and organization-scope comparisons
• Numeric normalization and date/time comparison
• Defined type compatibility and null/missing behavior
• Manifest validation and safe, value-free evaluation traces

0.7.0-preview.1 — First-Class Time and Context Policies

• Explicit-time-zone workday and overnight schedules
• Before, after, and bounded date-time policies
• Authentication-age, MFA-age, and reauthentication windows
• Canonical authentication, channel, network, tenant, organization, trusted-device, and identity-type context
• Deterministic TimeProvider testing and untrusted-by-default request context
• Angular TypeScript generation compatibility with backend requirement kinds

0.7.0-preview.2 — ASP.NET Core Enrichment Pipeline

• Subject, resource, and context attribute-provider abstractions
• Ordered asynchronous enrichment with cancellation
• Explicit attribute precedence and collision behavior
• Fail-closed provider exceptions and missing trusted data
• Sensitive-value-safe diagnostics
• Minimal-hosting and Startup.cs integration paths
• ASP.NET Core enrichment guide

0.8.0-preview.1 — Official Reference Applications

• A minimal ASP.NET Core authorization sample
• A modern Angular sample using generated identifiers, guards, and directives
• A full-stack document-approval sample with ASP.NET Core, Angular, Keycloak, YAML policies, and a sample data store
• Docker Compose setup for the API and web application, with documented Keycloak configuration, test identities, and authorization scenarios
• Package-consuming examples rather than source-project shortcuts
• Initial framework-independent TypeScript client and legacy-adapter feasibility work required by the compatibility track

The full-stack sample uses the current stable .NET, Angular, and Keycloak versions at implementation time. Smaller compatibility samples cover legacy hosting and Angular patterns.

0.8.0-preview.2 — Policy Testing CLI

• rulegate test [authorization.tests.yaml]
• Human-readable and JSON output
• Allow, deny, and indeterminate expectations
• Expected failure codes, filtering, summaries, and stable CI exit codes
• Manifest and test-fixture validation
• Deterministic execution without starting the host application
• Policy testing guide

0.9.0-preview.1 — Explain and Lint

• rulegate explain [authorization.tests.yaml] --test <id>
• Value-free structural explanations using the runtime evaluator pipeline
• Redaction of request values and identity-specific data by default
• rulegate lint [rulegate.yaml] for duplicate, contradictory, absorbed, overly deep, or unnecessarily complex requirements
• Requirement identifier collisions and risky negative-operator detection
• Stable human-readable and machine-readable output
• Explain and Lint guide

0.9.0-preview.2 — Policy Sources and Atomic Reload

• In-memory, YAML file, embedded-resource, configuration, and application-defined policy sources
• Complete parse and validation before activation
• Immutable policy snapshots and atomic replacement
• Preservation of the last valid snapshot when a reload fails
• Deterministic reload diagnostics and concurrency tests
• Policy sources and atomic reload guide

0.9.0-preview.3 — OpenTelemetry, Benchmarks, and Concurrency

• Low-cardinality authorization metrics, activities, and traces
• Decision, bounded failure-category, latency, policy-lookup, source-load, and reload instrumentation
• No subject IDs, resource IDs, policy/source identifiers, raw roles, permissions, claims, or attribute names and values in built-in telemetry
• Benchmarks for scalar, collection, attribute-to-attribute, logical, time, and context requirements
• Policy lookup benchmarks at 10, 100, 1,000, and 10,000 policies
• Immutable-snapshot, parallel-evaluation, cancellation, provider, and reload race-condition tests
• Configurable long-running stress tests and documented thread-safety contracts
• Telemetry, performance, and concurrency guide

0.9.0-preview.4 — .NET and Angular Compatibility

• .NET Standard 2.0 targets for Abstractions, Core, and Manifest
• ASP.NET Core and Keycloak packages from .NET Core 3.1 through .NET 10
• Framework-independent @fotbiler/rulegate-client
• Modern Angular adapter support for Angular 20–22
• Legacy Angular adapter support for Angular 12–19
• Host-owned client integration path for Angular 9–11
• Packed .nupkg and .tgz consumer verification across the compatibility matrix
• Unified 0.9.0-preview.4 preview numbering across the NuGet and npm package families

1.0.0-rc.1 — API Freeze and Security Hardening

No major feature is added during the release-candidate phase. Delivered scope includes:

• public API, naming, nullability, cancellation, exception, and thread-safety review;
• API approval snapshots, binary-compatibility checks, and migration guidance;
• fail-closed integrity, property-based, and manifest fuzz testing;
• requirement-depth, manifest-size, collection-size, and regex limits;
• YAML parser, dependency, and supply-chain hardening;
• reproducible package builds and sensitive-diagnostics review;
• completed current and legacy package-only consumer matrices;
• published compatibility and support policy.

1.0.0 — Stable Release

RuleGate 1.0 provides:

• RBAC, permission-based authorization, ABAC, CBAC, resource rules, and logical composition;
• scalar, string, collection, presence, null, attribute-to-attribute, time, and context requirements;
• ASP.NET Core integration and attribute enrichment;
• modern Angular integration and the validated compatibility adapters;
• optional Keycloak adapters without provider coupling;
• YAML manifests, validation, C# and TypeScript generation, policy tests, explanations, and linting;
• local policy sources with atomic reload;
• OpenTelemetry integration and documented performance/concurrency behavior;
• official backend, frontend, full-stack, and compatibility samples;
• stable public APIs and security documentation.

Post-stable roadmap

Post-stable work is tracked in two separate lanes:

• repository initiatives improve documentation, samples, adoption, demonstrations, and project assets without creating a RuleGate package version by themselves;
• versioned product milestones change published packages, public APIs, runtime behavior, integration contracts, or compatibility guarantees.

Repository initiatives may be delivered incrementally on main. A semantic version is assigned only when a published RuleGate product contract changes.

Repository initiatives

Book-Style Documentation and GitHub Wiki — Available

• Connected fourteen-chapter beginner-to-production guide and glossary
• Complete NuGet, npm, manifest, backend, frontend, CLI, testing, diagnostics, reload, extensibility, and production guidance
• Real-world recipes with YAML, backend, frontend, tests, and security context
• Mermaid decision and lifecycle diagrams with focused comparison tables
• Concise product README and package-level documentation links
• Generated GitHub Wiki with shared navigation
• Automated local-link, heading-anchor, and Wiki-build verification
• Repeatable main-branch Wiki synchronization

Documentation and Wiki maintenance continue as repository work. They do not receive a standalone RuleGate package version.

Multi-Domain and Multi-Stack Sample Portfolio — Active

• Expand the existing minimal ASP.NET Core and document-approval applications with focused domain and compatibility samples
• Cover healthcare, student information, fintech, ERP, B2B, e-commerce, CRM, and additional domains when they demonstrate distinct authorization problems
• Use different backend styles, frontend frameworks, UI libraries, identity providers, persistence technologies, and supported platform generations
• Demonstrate RBAC, permission-based authorization, ABAC, CBAC, ownership, tenant and organization scope, workflow state, separation of duties, time rules, trusted-device context, MFA age, and break-glass scenarios
• Consume published RuleGate packages instead of source-project references
• Include deterministic manifests, policy tests, allow and deny scenarios, security boundaries, and package-only verification
• Provide explicit vendor end-of-life and security guidance for legacy stacks
• Keep an open-source and reproducible default execution path for new samples

The sample portfolio is a continuous repository initiative. Adding or expanding a sample does not create a RuleGate package version by itself.

When sample development identifies a required public API, runtime, package, or compatibility change, that product change is planned and released separately under Semantic Versioning.

The canonical domain, technology, version, authorization-pattern, and delivery matrix is maintained in samples/README.md.

Versioned product roadmap

The numbered milestones below define the intended delivery order for published RuleGate product families and integrations.

1.1.0 — Native Java Package Family

• Framework-independent Java authorization core
• Spring Boot starter and integration layer
• Native Java extension points
• Maven Central publishing
• Package-consumer verification, samples, and documentation
• Shared manifest semantics and equivalent fail-closed behavior

1.2.0 — Native PHP Package Family

• Framework-independent Composer package
• Optional Laravel and Symfony adapters
• Native PHP extension points
• Packagist publishing
• Package-consumer verification, samples, and documentation
• Shared manifest semantics and equivalent fail-closed behavior

1.3.0 — React Integration

• Provider and context integration
• Authorization hooks and conditional-rendering components
• Route and navigation patterns
• Fail-closed loading, denied, and stale-state behavior
• Generated identifier consumption
• Backend-enforced authorization boundary

1.4.0 — Vue Integration

• Installable Vue plugin
• Authorization composables and directives
• Router-guard patterns
• Fail-closed loading, denied, and stale-state behavior
• Generated identifier consumption
• Backend-enforced authorization boundary shared with Angular and React

Compatibility track

The delivered .NET compatibility model is:

• Abstractions, Core, and Manifest target .NET Standard 2.0 plus .NET 8–10.
• ASP.NET Core and Keycloak integration packages target .NET Core 3.1 and every .NET release from 5 through 10.
• The CLI remains on .NET 8–10; generated source is verified independently.
• Packed NuGet consumers build every target and execute inside isolated .NET Core 3.1, .NET 5, .NET 6, and .NET 7 runtime containers as well as installed .NET 8–10 runtimes.

The delivered frontend compatibility model is:

• @fotbiler/rulegate-client owns framework-independent fail-closed state.
• @fotbiler/rulegate-angular targets Angular 20–22 with signals, standalone APIs, functional guards, and modern directives.
• @fotbiler/rulegate-angular-legacy targets Angular 12–19 with observables, NgModule, class guards, and classic directives.
• Angular 9–11 use the framework-independent client through a host-owned service because those versions predate the stable partial-Ivy library format.
• Packed .tgz consumers build real production applications on representative Angular 9–22 versions.

Compatibility is accepted only when consumers install packed .nupkg or .tgz artifacts and pass the defined build and authorization tests. Source-only compatibility does not satisfy the roadmap. See the frontend compatibility guide for package selection. The complete current-versus-legacy policy is documented in Platform compatibility.

Roadmap principles

All roadmap work must preserve these principles:

• Backend authorization remains the security boundary.
• Authorization defaults to deny.
• Missing and malformed policies fail closed.
• Provider-specific integrations remain optional.
• Core authorization remains local-first.
• Public APIs are tested through package-only consumers.
• Diagnostics and telemetry do not expose sensitive inputs by default.
• Generated output is deterministic.
• Repository initiatives do not imply package-version changes.
• Samples consume published packages and keep backend authorization as the security boundary.
• Legacy compatibility never weakens current-runtime security guarantees.