Struct Label 

pub struct Label {
    pub provenance: BTreeSet<SourceId>,
    pub trust: Trust,
    pub sensitivity: Sensitivity,
    pub data_subjects: BTreeSet<SubjectRef>,
}

A value’s position in the information-flow lattice.

A pure product of three joins — provenance unions, trust degrades, sensitivity escalates. Release marks are deliberately not part of a label: a mark is scoped to the one value a release was granted over, while a label flows through every join a derived value is built from, so a mark stored here would ride any bare join onto data it never covered unless every call site remembered to strip it. Marks live on Tainted instead, where the operations that can prove value lineage — projection, assembly, transformation — are the only ways to move one.

Fields

provenance: BTreeSet<SourceId>

Every source that influenced this value, unioned through each join.

It answers influenced by these, never this sentence came from that one. The set is a property of the whole value: a completion written from three recalled memories carries all three, and nothing here says which clause owes which. That granularity is deliberate — the only form of claim-level attribution this runtime could derive is a verbatim span match, which would attribute exactly what a model copied and silently omit everything it paraphrased, so an absent citation would read as not derived from while meaning not copied from. A set that over-covers is honest; a citation that under-covers is not.

Over-coverage is the safe direction and is what the gates are built on: a protected field’s allowed_sources refuses a value whose set contains anything unlisted, so a source that merely might have contributed still stops the call.

Not to be confused with Provenance, which names the call a value came out of — run, case, effect — rather than the sources that shaped it.

trust: Trust

How far this value may be believed. Degrades on join, improves only through a typed, policy-authorized release.

sensitivity: Sensitivity

How far this value may travel. Escalates on join to the most sensitive contributor, and gates every sink that declares a ceiling.

data_subjects: BTreeSet<SubjectRef>

Which data-subject bindings this value was influenced by, unioned through each join.

Attribution only: no gate reads it, and no policy request carries it — neither as context.label nor inside a label an effect’s arguments embed, which the request builder projects the same way. It is not a member of provenance because provenance is a gate input — a protected field’s allowed_sources refuses any unlisted source — so a subject there would refuse every subject-bound value. A reference names a binding, never the person: the subject itself is sealed in the run’s DataSubjectBound record. A reference in a label an embedder supplied with a run’s input is the embedder’s claim, which nothing checks. Omitted from the wire when empty.

Implementations

impl Label

pub fn trusted() -> Self

The lattice bottom: trusted, public, no provenance.

pub fn untrusted(source: SourceId) -> Self

A value that crossed a trust boundary — every tool result, every retrieval, every peer response, including from first-party services. A compromised internal service is exactly what this exists for.

pub fn with_sensitivity(self, s: Sensitivity) -> Self

pub fn join(&self, other: &Self) -> Self

Bounded join-semilattice: trust degrades, sensitivity escalates, provenance and data-subject references accumulate.

Nothing else rides a join. In particular a join can never transport a release: marks live on Tainted, not here, so combining labels — however a caller does it — cannot extend a grant to data the release never covered.

pub fn for_policy(&self) -> Self

This label as a policy request carries it: without data_subjects, which no gate reads.

pub fn is_untrusted(&self) -> bool

Trait Implementations

impl Clone for Label

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Label

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Label

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Label

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Label

impl PartialEq for Label

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Label

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Label