Struct Security 

pub struct Security {
    pub max_sensitivity_egress: Option<Sensitivity>,
    pub max_sensitivity_journaled: Option<Sensitivity>,
    pub max_delegation_depth: Option<u8>,
    pub content: Option<Content>,
}

The constraints a runtime enforces.

Fields

max_sensitivity_egress: Option<Sensitivity>

The highest sensitivity any value may reach an outward sink at. Combined with the sink’s own ceiling at dispatch; the stricter limit wins.

max_sensitivity_journaled: Option<Sensitivity>

The highest sensitivity a value may reach an effect whose arguments the journal records.

A different question from max_sensitivity_egress, and the one that decides whether personal data in a run can ever be erased. The journal is append-only, so an argument recorded there — a model prompt, a tool call’s arguments — is never removed. Egress asks may this leave; this asks may this be written down forever.

This is the refuse it answer. The seal it answer is RuntimeBuilder::keyring, which puts the same payloads under a per-case data key that erase_case destroys, reaching every copy including backups. They compose rather than compete: a sealed deployment may still declare a ceiling for the classes it would rather never hold at all, since a sealed record is still a record and a key ring is still an operational dependency.

Absent means unbounded. Setting it makes the mistake a refusal at dispatch rather than a discovery at an erasure request: bytes above the ceiling belong in a blob, with the chain committing to the digest.

max_delegation_depth: Option<u8>

How far authority may be re-delegated. Checked both against the runtime’s configured identity and against every delegating sink before dispatch.

content: Option<Content>

Rules over a value’s content, applied at admission, where an effect’s output arrives, and at sinks. They may refuse a value, raise its sensitivity or redact it at a sink — never admit, trust or lower it.

Trait Implementations

impl Clone for Security

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Security

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Security

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Security

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Security

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for Security

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Security

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Security