Enum PolicyError 

#[non_exhaustive]
pub enum PolicyError {
    Denied {
        principal: String,
        action: String,
        resource: String,
    },
    Recorded {
        reason: String,
    },
    TaintGate {
        sink: String,
    },
    UnboundSinkArguments {
        sink: String,
    },
    SinkGateRequired {
        sink: String,
    },
    SinkArgumentsMismatch {
        sink: String,
        at: String,
        bound: Digest,
        sent: Digest,
    },
    ProtectedFieldMissing {
        sink: String,
        path: String,
    },
    ProtectedFieldTaint {
        sink: String,
        path: String,
    },
    ReleaseDestination {
        sink: String,
        granted: String,
        actual: String,
    },
    ProtectedFieldReleaseDestination {
        sink: String,
        path: String,
        granted: String,
        actual: String,
    },
    ProtectedFieldSource {
        sink: String,
        path: String,
        actual_source: String,
    },
    ProtectedFieldValue {
        sink: String,
        path: String,
    },
    ProtectedFieldSensitivity {
        sink: String,
        path: String,
        actual: Sensitivity,
        ceiling: Sensitivity,
    },
    UntrackedReleaseField,
    InvalidRelease {
        detail: String,
    },
    JournalCeiling {
        sink: String,
        actual: Sensitivity,
        ceiling: Sensitivity,
    },
    EgressCeiling {
        sink: String,
        actual: Sensitivity,
        ceiling: Sensitivity,
    },
    DelegationDepth {
        sink: String,
        actual: usize,
        ceiling: usize,
    },
}

Authorization failure.

Evaluation is total and side-effect free, so this never means “the policy engine was unreachable” — that state cannot arise.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Denied

Fields

principal: String

action: String

resource: String

Recorded

A sink-gate refusal read back from the journal.

Carries the recorded wording rather than re-deriving a variant from it, for the reason BudgetExceeded::Recorded does: the run stopped for the reason it recorded, and a replay that re-worded it makes an auditor compare a run’s status against its own replay and find a difference that means nothing.

It is a PolicyError rather than a StepError::Denied because which gate refused survives the round trip and matters: a sink gate refuses one call, and a tool-calling loop may tell the model and try another route, where an authorization denial ends the run. Collapsing the two on the way back would end a run the original finished.

Fields

reason: String

TaintGate

An argument derived from untrusted data reached a mutating sink without an explicit, policy-authorized release.

Fields

sink: String

UnboundSinkArguments

A sink did not expose the value it will send, so the runtime cannot bind the information-flow decision to the outbound call.

Fields

sink: String

SinkGateRequired

A caller tried to dispatch an outbound-value effect through the generic effect API, bypassing information-flow enforcement.

Fields

sink: String

SinkArgumentsMismatch

The labeled value presented to the gate differs from the value the sink will send.

The rule is exact equality, so that they differ is the whole verdict; the reader also needs where, or is left with two documents and a diff by eye — and the commonest case, a bound payload still at its null default beside a labelled object, is the least visible. So the refusal names the first differing RFC 6901 pointer ("" at the root) and both canonical digests. Neither value is printed: the labelled one is the data these gates exist to keep out of a log, and a digest identifies it to whoever already holds it while disclosing nothing to anyone else.

Fields

sink: String

at: String

RFC 6901 pointer to the first difference; "" is the whole value.

bound: Digest

Digest of the canonical bytes the effect will actually send.

sent: Digest

Digest of the canonical bytes presented to the gate.

ProtectedFieldMissing

A field the sink declares security-sensitive is absent from the value.

Fields

sink: String

path: String

ProtectedFieldTaint

Untrusted data attempted to choose a protected sink argument.

Fields

sink: String

path: String

ReleaseDestination

A destination-scoped release covers this value — but for a different sink. Named explicitly, because “untrusted” alone would send the operator hunting for a missing release that in fact exists and was simply granted somewhere else. The message names only the two destinations — never the release’s basis or evidence, which would hand a probing model the reviewer’s reasoning.

Fields

sink: String

granted: String

actual: String

ProtectedFieldReleaseDestination

The field-scoped twin of ReleaseDestination.

Fields

sink: String

path: String

granted: String

actual: String

ProtectedFieldSource

A protected field derives from a source outside its operator declaration.

Fields

sink: String

path: String

actual_source: String

ProtectedFieldValue

A protected field carries a value outside its declared set.

The message names the constraint and deliberately not the value: the value is untrusted-influenced by construction, and echoing it hands an injected payload a path into logs and refusal channels. The manifest is where a reader sees what is permitted.

Fields

sink: String

path: String

ProtectedFieldSensitivity

A protected field exceeds its own sensitivity ceiling.

Fields

sink: String

path: String

actual: Sensitivity

ceiling: Sensitivity

UntrackedReleaseField

A field-specific release was requested for a value whose field lineage was never tracked.

InvalidRelease

A serialized release bypassed the safe constructors and violated the typed-release invariants.

Fields

detail: String

JournalCeiling

A value’s sensitivity exceeds what this agent may write into the journal.

Distinct from EgressCeiling, and the distinction is the whole point: egress asks may this leave, this asks may this be written down forever. The journal is append-only, so an argument recorded there — a prompt, a tool call’s arguments — is never removed. A deployment with an erasure obligation has two answers and this ceiling is the first: refuse the data at dispatch, rather than meet an impossibility at the erasure request. The second is to seal it — RuntimeBuilder::keyring puts payloads under a per-case key that erase_case destroys — and the two compose: a deployment may seal everything and still refuse the classes it would rather never hold.

The message names both, because a reader who has configured a key ring and then meets this refusal would otherwise conclude the seal is not working.

Fields

sink: String

actual: Sensitivity

ceiling: Sensitivity

EgressCeiling

A value’s sensitivity exceeds what the sink is allowed to receive. This is the exfiltration path that matters: not the network, but a legitimate-looking tool call carrying a secret read three steps ago.

Fields

sink: String

actual: Sensitivity

ceiling: Sensitivity

DelegationDepth

A handoff would make the authority chain deeper than this agent’s reviewed declaration permits.

Fields

sink: String

actual: usize

ceiling: usize

Implementations

impl PolicyError

pub const fn for_model(&self) -> &'static str

The one sentence a model may be shown.

Uniform across every variant, deliberately — see REFUSED. Use Display for the journal and for operators, and this for anything that reaches a prompt.

Trait Implementations

impl Debug for PolicyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PolicyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for PolicyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<PolicyError> for RuntimeError

fn from(source: PolicyError) -> Self

Converts to this type from the input type.

impl From<PolicyError> for StepError

fn from(source: PolicyError) -> Self

Converts to this type from the input type.