Expand description
Capability vocabulary for the canonical policy AST.
This is the leaf-crate-owned capability model. It deliberately mirrors the
file_read / file_write / network_outbound / terminal_exec / … wire
vocabulary used by policy-examples/*.yaml so the canonical
PolicyDocument parses the same on-disk contract
the gateway already honours.
It lives in aa-security (a leaf crate with no aa-core dependency)
because aa-core itself depends on aa-security; defining the shared
policy AST here is what lets BOTH the gateway rule engine and the
(privilege-separated) eBPF loader depend on the exact same types without a
dependency cycle. See AAASM-3606.
Structs§
- Capability
Set - Aggregates allow and deny capability sets for a given policy scope.
Enums§
- Capability
- A discrete action category a policy can allow or deny for an agent.