aa_security/policy/
mod.rs

1//! The canonical, cross-layer policy AST and its compilers.
2//!
3//! This module is the single source of truth for policy structure. It lives in
4//! `aa-security` (a leaf crate) so that BOTH the gateway rule engine (L7) and
5//! the privilege-separated eBPF loader (kernel) can depend on the exact same
6//! types without a dependency cycle — `aa-core` already depends on
7//! `aa-security`, so the AST cannot live in `aa-core`.
8//!
9//! See AAASM-3606 (extract AST), AAASM-3607 (gateway consumes it), and
10//! AAASM-3608 (lower it to eBPF map entries).
11//!
12//! # Layout
13//!
14//! - [`capability`] — the `file_read` / `network_outbound` / `mcp_tool:<n>`
15//!   capability vocabulary.
16//! - [`document`] — [`PolicyDocument`] and its sub-structures.
17//! - [`parse`] — YAML parsing of the `policy-examples` on-disk contract.
18//! - [`ebpf`] — deterministic lowering of the AST to eBPF map entries
19//!   (AAASM-3608, extended for syscalls by AAASM-3635).
20//! - [`syscall`] — the `SyscallAllowlist` kernel-syscall node (AAASM-3624).
21
22pub mod capability;
23pub mod document;
24pub mod ebpf;
25pub mod error;
26#[cfg(feature = "serde")]
27pub mod parse;
28pub mod syscall;
29
30pub use capability::{Capability, CapabilitySet};
31pub use document::{NetworkPolicy, PolicyDocument, ToolRule};
32pub use ebpf::{lower_to_ebpf, EbpfRuleSet, PathRule, PathVerdict};
33pub use error::PolicyParseError;
34pub use syscall::{Syscall, SyscallAllowlist};
aa_security/policy/mod.rs

aa_security/policy/
mod.rs
