Function validate_policy 

pub fn validate_policy(
    capabilities: &BackendCapabilities,
    policy: &SandboxPolicy,
) -> Result<(), ExecutionError>

Available on crate feature code only.

Validates that the backend can enforce the requested sandbox policy.

Returns Err(ExecutionError::UnsupportedPolicy(...)) if any requested control cannot be enforced by the backend. This implements fail-closed semantics: execution is rejected before user code runs.

Checks

• Network policy: if disabled, backend must be able to enforce it
• Filesystem policy: if any access is requested, backend must enforce it
• Environment policy: backend must always enforce it — both EnvironmentPolicy::None and EnvironmentPolicy::AllowList restrict what the code sees, and a backend that cannot enforce either passes the host environment through
• Timeout: backend must always be able to enforce timeouts

Errors

Returns ExecutionError::UnsupportedPolicy naming the first control the backend cannot enforce.