Struct AdminConfig 

pub struct AdminConfig {
    pub agent_ids: Vec<String>,
}

v0.7.0 SHIP cluster (#946 / #957 / #960 / #961, 2026-05-20) — [admin] top-level block. The operator-configured allowlist of agent_ids whose authenticated HTTP requests are treated as admin-class callers, granting full cross-tenant visibility on endpoints whose payloads necessarily expose corpus-scale metadata (GET /api/v1/export, GET /api/v1/agents, GET /api/v1/stats, the POST /api/v1/quota/status list path).

Wire format:

[admin]
agent_ids = ["ops:admin", "ai:claude@workstation"]

Default-closed. When the block is absent, the allowlist is empty and every admin-class endpoint returns 403 Forbidden for every caller. Operators MUST set [admin].agent_ids = [...] explicitly to grant any caller admin privileges. This closes the v0.7.0 SHIP-blocking cross-tenant exfiltration defects (#946 / #957 / #960) where admin endpoints landed open by default because the legacy api_key_auth middleware passes through when no API key is configured.

Caller resolution uses the same primitive other handlers do (identity::resolve_http_agent_id against X-Agent-Id). The allowlist matches against the resolved caller string verbatim; there is no glob / prefix support today (planned under #961 when the operator surface grows beyond a static list).

Not a substitute for authentication. The role gate runs AFTER api_key_auth. Deployments serving sensitive corpora MUST set api_key so the bare-network surface requires the key AND the role gate runs on top of it. The two layers compose: api_key_auth answers “is the request authenticated?” and the admin gate answers “is the authenticated caller an admin?”.

Fields

agent_ids: Vec<String>

Explicit list of agent_id strings whose authenticated requests are treated as admin-class. Default vec![] (empty) means no caller is an admin — every admin-class endpoint returns 403.

Each entry MUST match a caller’s resolved agent_id verbatim. Validation: the SAL accepts the same NHI agent_id charset that crate::validate::validate_agent_id enforces (see the “Agent Identity (NHI)” section of CLAUDE.md). Entries that fail validation at boot are logged at warn and dropped from the in-memory allowlist; the daemon still starts so a single typo does not lock the operator out.

Implementations

impl AdminConfig

pub fn validated_agent_ids(&self) -> Vec<String>

Returns the validated subset of agent_ids — entries that pass crate::validate::validate_agent_id. Entries that fail validation are dropped (with a warn log) so a single typo in config.toml cannot lock the operator out.

Trait Implementations

impl Clone for AdminConfig

fn clone(&self) -> AdminConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdminConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AdminConfig

fn default() -> AdminConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AdminConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AdminConfig

impl PartialEq for AdminConfig

fn eq(&self, other: &AdminConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AdminConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AdminConfig