Enum PolicyDecision 

pub enum PolicyDecision {
    Permit,
    Deny {
        reason: String,
    },
    Malformed {
        reason: String,
    },
}

The answer.

Not a Result, on purpose: there is no error case. See the module docs on why a policy layer that can fail open is not a policy layer.

Variants

Permit

Deny

Refused, with a reason an operator can act on.

The reason is required. “Denied by policy” sends someone to read a policy set looking for which of forty rules fired, which is how an authorization layer becomes something people route around.

It says which rule, not which request. Every caller of this trait already holds the action and the resource and puts them in the message it raises and the record it journals — see StepError::Denied. An engine that repeats them produces policy denied 'effect:perform' on 'tool.call': 'effect:perform' on 'tool.call' refused by …, which spends the half of the line an auditor reads on saying the same thing twice. The half the wrapper cannot know is which rule fired, and that is this string’s job.

Fields

reason: String

Malformed

The rules could not be evaluated, so nothing may be concluded from them — refused, but not by a rule.

A separate variant because the rules say no and the rules are broken call for opposite responses, and while both were spelled Deny the difference existed only inside a reason string. Nothing could branch on it without matching on message text, which is how a reworded sentence changes behaviour — so a deployment whose policy set had begun erroring on every request read it as ordinary refusals and spent an afternoon looking for the rule that fired.

It is still a refusal at the gate: an unevaluable rule may be exactly the forbid that would have stopped this call. What changes is who is told and what they are told to fix — the policy set, not the request.

Fields

reason: String

Implementations

impl PolicyDecision

pub fn deny(reason: impl Into<String>) -> Self

Deny with a reason.

pub fn malformed(reason: impl Into<String>) -> Self

Refuse because the rules themselves could not be evaluated.

pub const fn is_permit(&self) -> bool

pub const fn is_malformed(&self) -> bool

Whether this refusal is a defect in the rules rather than a rule firing. The distinction a boot-time check reads, and the one an operator’s alerting should treat as an incident.

pub fn reason(&self) -> Option<&str>

The reason, whichever kind of refusal this is.

Trait Implementations

impl Clone for PolicyDecision

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyDecision

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PolicyDecision

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PolicyDecision

impl PartialEq for PolicyDecision

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PolicyDecision

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PolicyDecision