Enum AxisEnforcement 

pub enum AxisEnforcement {
    Kernel,
    Interceptor,
    Advisory,
}

How a single restricted Caveat axis is actually enforced for a run (ADR 0004 D1).

Variants

Kernel

An OS ruleset enforces this axis against the spawned program’s interior (e.g. Landlock on fs_write). The strongest claim.

exec → kernel is about identity, not behavior (ADR 0013 D6 / agent-bridle#114). It means “no un-granted program can run as a process” — via Seatbelt process-exec* (ADR 0014), or a Linux minimal rootfs that physically excludes un-granted binaries (ADR 0013). It does NOT mean a granted program — especially a granted interpreter (sh, python, perl) — is constrained in what it does: its interior logic is still bounded only by the fs_read/fs_write/net axes (read those for the data-side guarantee). Do not read exec → kernel as “this program will only do what I expect.”

Interceptor

The in-process L2 leash gates this axis at the spawn/open chokepoint — it holds for the engine’s own operations, not for a permitted external child’s interior (a find -exec child’s reads escape it).

Advisory

Validated at admission, then ambient — nothing backstops the spawned interior. Honest “we checked the request, we cannot confine the effect.”

Trait Implementations

impl Clone for AxisEnforcement

fn clone(&self) -> AxisEnforcement

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AxisEnforcement

impl Debug for AxisEnforcement

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AxisEnforcement

fn deserialize<__D>( __deserializer: __D, ) -> Result<AxisEnforcement, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AxisEnforcement

impl Ord for AxisEnforcement

fn cmp(&self, other: &AxisEnforcement) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for AxisEnforcement

fn eq(&self, other: &AxisEnforcement) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for AxisEnforcement

fn partial_cmp(&self, other: &AxisEnforcement) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for AxisEnforcement

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AxisEnforcement