Module policy 

The canonical, cross-layer policy AST and its compilers.

This module is the single source of truth for policy structure. It lives in aa-security (a leaf crate) so that BOTH the gateway rule engine (L7) and the privilege-separated eBPF loader (kernel) can depend on the exact same types without a dependency cycle — aa-core already depends on aa-security, so the AST cannot live in aa-core.

See AAASM-3606 (extract AST), AAASM-3607 (gateway consumes it), and AAASM-3608 (lower it to eBPF map entries).

Layout

• capability — the file_read / network_outbound / mcp_tool:<n> capability vocabulary.
• document — PolicyDocument and its sub-structures.
• [parse] — YAML parsing of the policy-examples on-disk contract.
• ebpf — deterministic lowering of the AST to eBPF map entries (AAASM-3608, extended for syscalls by AAASM-3635).
• syscall — the SyscallAllowlist kernel-syscall node (AAASM-3624).

Re-exports

pub use capability::Capability;

pub use capability::CapabilitySet;

pub use document::NetworkPolicy;

pub use document::PolicyDocument;

pub use document::ToolRule;

pub use ebpf::lower_to_ebpf;

pub use ebpf::EbpfRuleSet;

pub use ebpf::PathRule;

pub use ebpf::PathVerdict;

pub use error::PolicyParseError;

pub use syscall::Syscall;

pub use syscall::SyscallAllowlist;

Modules

capability

Capability vocabulary for the canonical policy AST.

document

The canonical, cross-layer policy AST.

ebpf

Deterministic lowering of the canonical PolicyDocument into the flat rule set the eBPF maps consume (AAASM-3608).

error

Errors raised while parsing the canonical policy AST.

syscall

Syscall-allowlist node for the canonical policy AST (AAASM-3624).