CoSecMulti-tenant reactive security for Spring

IAM-style policies and role-based permissions, evaluated deny-first for every request.

Policies as data

JSON policies with path actions, composable conditions and rate limits. Deny wins across every layer, and anything unmatched is denied.

Tenant-aware principals, plus per-application permission catalogs granted to roles per space.

Built on Project Reactor. About 2 µs per decision, with no event-loop blocking.

One security pipeline behind three adapters that respond identically.

Token issuing, refresh and immediate revocation, plus OAuth login through JustAuth.

An audit event and an OpenTelemetry span for every decision, naming the policy or permission that decided it.