1 files changed, 32 insertions, 2 deletions
diff --git a/include/PermissionsManager.h b/include/PermissionsManager.h
index c51bd27..6d79642 100644
--- a/include/PermissionsManager.h
+++ b/include/PermissionsManager.h
@@ -6,14 +6,44 @@
 
 #include <set>
 
+/**
+ * @file PermissionsManager.h
+ * @brief Declares authentication and object-access checks.
+ */
+
 namespace nt
 {
+    /**
+     * @brief Evaluates connection claims and object permissions.
+     *
+     * Permission checks are intentionally separated from lookup. The object
+     * manager can retrieve a candidate object, while this manager decides
+     * whether the caller is allowed to use it.
+     */
     class NT_API PermissionsManager
     {
     public:
-        // For validating connections at login
+        /**
+         * @brief Validates a connection during login.
+         * @param method Authentication method used by the connection.
+         * @return Claims granted to the authenticated connection.
+         */
         std::set<AUTH_CLAIM> Firewall(AUTH_METHOD method);
-        // For validating permission to an object
+
+        /**
+         * @brief Validates permission to an object.
+         *
+         * Checks the security descriptor on the head of the object found in
+         * ObjectManager::registry. It should also check connection metadata
+         * that is still to be defined, such as user group and policy.
+         *
+         * It is still undecided whether this should run on every attempt to get
+         * hold of an object, since that might produce significant overhead.
+         *
+         * @param object Object being accessed.
+         * @param connection_context Connection metadata for the caller.
+         * @return True when access is allowed.
+         */
         const bool Access(const ObjectManager::registry* object, const void* connection_context);
     };
 }