Enum PermissionsMode 

pub enum PermissionsMode {
    Enforce,
    Advisory,
    Off,
}

Enforcement posture consulted by crate::db::enforce_governance.

v0.7.0 K3 — closes the v0.6.3.1 honest-Capabilities-v2 disclosure that permissions.mode = "advisory" was advertised but the gate itself returned Deny / Pending regardless. The gate now actually honors this knob.

Wire format on config.toml:

[permissions]
mode = "advisory"   # or "enforce" / "off"

Variants

Enforce

Block on policy violation. Deny/Pending decisions returned to the caller as-is. The strict, audit-ready posture.

Advisory

Log a warning and allow the action. Governance metadata is recorded but does not block writes. Default for v0.7.0 to preserve the v0.6.x posture for upgrading operators.

Off

Skip the gate entirely. No policy resolution, no log, no pending_actions row. Useful for benchmarking and temporary freeze-thaw incident response.

Implementations

impl PermissionsMode

pub fn as_str(self) -> &'static str

Lowercase wire string for capabilities + doctor surfaces.

Trait Implementations

impl Clone for PermissionsMode

fn clone(&self) -> PermissionsMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PermissionsMode

impl Debug for PermissionsMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionsMode

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PermissionsMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PermissionsMode

impl PartialEq for PermissionsMode

fn eq(&self, other: &PermissionsMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for PermissionsMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PermissionsMode