Expand description
One contract, run against every policy engine.
The trait asks for three things no signature can express — total, pure, no
I/O — and the whole authorization story rests on them. Totality is why
there is no error case in PolicyDecision: a gate that can fail is a gate
that fails open on the day it matters. Purity is why an auditor holding the
journal can re-derive a verdict offline, which is a claim about the engine
and not only about the record. And the bundle identity is journaled at
admission, so a run’s answer to what governed this is only as good as an
implementation’s promise that the identity covers every static input.
None of that is checked by the type system, and the crate ships two implementations that agree — which is the condition under which a third implementation’s disagreement goes unnoticed.
What this battery cannot tell you: whether the rules are right. An
engine that permits everything passes every check here, exactly as
PolicyEngine::preflight’s own docs warn about an empty answer.
Functions§
- check
- Run the battery every policy engine answers, whatever it evaluates.