Module security 

Security Module

Provides a trait-based security interface for A3S Code sessions. External consumers implement SecurityProvider to plug in their own security logic (sanitization, taint tracking, injection detection, etc.).

Re-exports

pub use config::SecurityConfig;

pub use default::DefaultSecurityConfig;

pub use default::DefaultSecurityProvider;

pub use default::SensitivePattern;

Modules

config

Security Configuration

default

Default Security Provider

Structs

NoOpSecurityProvider

No-op security provider (default when security is disabled)

SecurityLabel

TaintedValue

A label travels with its value until an explicit boundary consumes it. These labels describe provenance; they never grant execution permission.

Enums

RedactionStrategy

Redaction strategy

SanitizationState

Whether the configured provider has processed the complete value.

SensitivityLevel

Sensitivity level for classified data

TaintLabel

Taint classification is independent of instruction authority and redaction.

TrustLevel

Trust provenance assigned by the owning adapter, never inferred from text.

Traits

SecurityProvider

Trait for pluggable security providers.

Functions

sanitize_agent_event

Sanitize every data-bearing field of an agent event while preserving the identifiers and discriminants used to correlate the event stream.

sanitize_tainted_json

Process complete JSON string values while retaining keys and protocol shape. Keys are protocol field names, not a channel for arbitrary output text.

sanitize_tainted_text

Apply output sanitization without promoting trust or declassifying taint.

sanitize_text

Convenience adapter for text values that enter the egress boundary without an existing wrapper.