CLI Reference

Complete reference for the bac-perf command-line tool.

Installation

cargo build --release --package perf-testing

The binary is at target/release/bac-perf.

Commands

generate

Generate HBAC, ABAC, LDAP ACI, POSIX ACL, or Windows SD rule fixtures for benchmarking.

bac-perf generate [OPTIONS]

Option	Description	Default
`--bac-type <TYPE>`	BAC type: `hbac`, `abac`, `ldap_aci`, `posix_acl`, or `win_sd`	`hbac`
`--count <N>`	Number of rules to generate	required
`--output <NAME>`	Output fixture name	required
`--distribution <PRESET>`	Distribution preset: `sssd-prod`, `dev`, `high-security`	`sssd-prod`
`--seed <N>`	Random seed for reproducibility	`42`
`--fixtures-dir <PATH>`	Fixtures directory	`fixtures`

# Generate HBAC fixture
bac-perf generate --bac-type hbac --count 1000 --output prod_1k \
  --distribution sssd-prod --seed 42

# Generate ABAC fixture (same distributions)
bac-perf generate --bac-type abac --count 1000 --output abac_1k \
  --distribution sssd-prod --seed 42

# Generate LDAP ACI / POSIX ACL / Windows SD fixtures (same flags)
bac-perf generate --bac-type ldap_aci --count 1000 --output ldap_1k --distribution sssd-prod --seed 42
bac-perf generate --bac-type posix_acl --count 1000 --output posix_1k --distribution sssd-prod --seed 42
bac-perf generate --bac-type win_sd --count 1000 --output winsd_1k --distribution sssd-prod --seed 42

Note: For LDAP ACI, POSIX ACL, and Windows SD, only the distribution preset’s deny-rule ratio is applied; the rest of the rule-pattern mix (read/write/admin/inheritance patterns, etc.) is fixed internally by each generator. The full preset (category=all ratios, disabled-rule ratio, temporal ratio) only applies to HBAC and ABAC.

bench

Run performance benchmarks against a fixture.

bac-perf bench [OPTIONS]

Option	Description	Default
`--bac-type <TYPE>`	BAC type: `hbac`, `abac`, `ldap_aci`, `posix_acl`, or `win_sd`	`hbac`
`--fixture <NAME>`	Fixture to benchmark	required
`--scenario <NAME>`	Benchmark scenario	`all`
`--cache`	Enable caching	disabled
`--jit`	Enable JIT compilation (requires `--features jit` build)	disabled
`--pipeline`	ABAC: use pipeline mode with an “all enabled” applicability filter	disabled
`--cache-size <N>`	ABAC: LRU cache size (number of entries)	`1024`
`--rules-capacity <N>`	ABAC: initial rules capacity (pre-allocation hint)	`100`
`--max-rules <N>`	Maximum number of rules to load (`0` = no limit); applies to HBAC and ABAC only	`0`
`--format <FORMAT>`	Output format: `terminal`, `json`, `csv`, `markdown`	`terminal`
`--output <PATH>`	Save results to file	stdout
`--fixtures-dir <PATH>`	Fixtures directory	`fixtures`

Scenarios:

Scenario	Description
`single-latency`	Request latency with warm cache (10K matching requests)
`check-access-latency`	Same as `single-latency` but uses `check_access()` (bool result) instead of `evaluate()`
`uncached-latency`	Raw evaluation without cache benefit (10K unique requests)
`throughput`	Sustained load with 80/20 match/non-match mix
`build-time`	Policy load and index construction time
`all`	Run all scenarios

# Benchmark HBAC
bac-perf bench --bac-type hbac --fixture prod_1k --scenario all --cache \
  --format json --output results.json

# Benchmark ABAC using HBAC fixture (automatic conversion)
bac-perf bench --bac-type abac --fixture prod_1k --scenario all \
  --format json --output abac_results.json

Note: ABAC can benchmark both ABAC and HBAC fixtures. When using an HBAC fixture with --bac-type abac, rules are automatically converted from the three-dimensional user/host/service model to the equivalent ABAC user/resource/action dimensions. This enables direct performance comparison. See Cross-BAC Benchmarking.

Note: --format markdown for bench prints only the fixed-width comparison table (the same one shown after multiple terminal results) — it is not literal pipe-delimited Markdown table syntax, despite the name. --format json and --format csv print one entry per scenario.

Note: --cache and --jit behave differently depending on --bac-type:

--cache toggles the cache for ABAC and LDAP ACI. HBAC always uses its built-in optimized pipeline (indexed cache, Bloom filter, decision tree) regardless of this flag. POSIX ACL and Windows SD do not use a cache at all.
--jit only has an effect for HBAC (and requires a --features jit build). It returns an error when combined with --bac-type abac, and is accepted but has no effect for LDAP ACI, POSIX ACL, and Windows SD.

list

List available fixtures.

bac-perf list [OPTIONS]

Option	Description	Default
`--verbose`	Show rule count, size, and generation date	summary only
`--fixtures-dir <PATH>`	Fixtures directory	`fixtures`

bac-perf list --verbose

compare

Compare two benchmark runs to detect regressions.

bac-perf compare <BASELINE> <CURRENT> [OPTIONS]

Argument	Description
`<BASELINE>`	Path to baseline JSON results
`<CURRENT>`	Path to current JSON results

Option	Description	Default
`--format <FORMAT>`	Output format: `terminal`, `markdown`	`terminal`

bac-perf compare baseline.json current.json

Note: --format markdown currently prints the same terminal-style comparison as the default, with an additional notice that markdown output is not yet implemented.

validate

Check fixture integrity (schema version, JSON structure, rule count consistency).

bac-perf validate <FIXTURE> [OPTIONS]

Argument	Description
`<FIXTURE>`	Fixture name to validate

Option	Description	Default
`--fixtures-dir <PATH>`	Fixtures directory	`fixtures`

bac-perf validate prod_1k

Exit codes

Code	Meaning
0	Success
1	Any error (invalid arguments, fixture not found, validation failure, benchmark failure, etc.)

BAC Rules Documentation