Crate agentstategraph_policy_cedar 

Cedar runner for AgentStateGraph policies (0.7.5 §4b).

CedarEvaluator shells out to the cedar binary on $PATH (or an explicit override via CedarEvaluator::new_with_path). The Cedar source is written to a temp file, an entities.json and a request.json are synthesized per-call, and the decision is pulled from the decision field of cedar authorize’s JSON output.

Entity / request model

A single Agent entity is synthesized per call:

{ "uid": {"type": "Agent", "id": "<agent_id>"}, "attrs": {}, "parents": [] }

The request is:

• principal = Agent::"<agent_id>"
• action = Action::"<action>"
• resource = Situation::"default"
• context = { "situation": <situation-map> }

Invocation:

cedar authorize \
  --policies  <policies.cedar> \
  --entities  <entities.json> \
  --request-json <request.json>

The decision is read from the decision field of the JSON output and mapped: Allow → Decision::Allow, Deny → Decision::Deny, everything else → Decision::NoPolicyMatch. matched_policy is the first entry in determining_policies, or the literal "cedar" if absent.

Source variants

• EvaluatorSource::Inline — body is Cedar policy source text.
• EvaluatorSource::FilePath — Cedar source path is passed through to cedar authorize --policies.
• EvaluatorSource::CommitRef — unsupported here; resolve via [PolicyStore] before dispatch. Returns ExternalError::SourceResolution.

Structs

CedarEvaluator

Shells out to cedar authorize.