Struct PermissionsConfig 

pub struct PermissionsConfig {
    pub mode: Option<PermissionsMode>,
    pub rules: Vec<PermissionRule>,
}

[permissions] block in config.toml. Carries the gate’s enforcement posture and (v0.7.0 K9) the declarative rule list the unified crate::permissions::Permissions::evaluate pipeline consults before mode + hook fall-through.

Wire format (rules — K9):

[permissions]
mode = "enforce"

[[permissions.rules]]
namespace_pattern = "secrets/*"
op               = "memory_store"
agent_pattern    = "ai:*"
decision         = "deny"
reason           = "ai agents may not write to secrets"

Rules are deny-first and longest-pattern-wins; see crate::permissions module docs for the full combination rule.

Fields

mode: Option<PermissionsMode>

Enforcement mode. None when the operator declared a [permissions] block but omitted mode = — this is the “partial config” case that B4 (S5-M3) closes: such a block MUST NOT silently fall back to the serde-derived PermissionsMode::default (advisory), because the v0.7.0 secure default is enforce. The AppConfig::effective_permissions_mode resolver maps Some(cfg { mode: None }) to the secure default + a migration warning, so an operator who half-typed [permissions] and forgot the mode line still ships enforce, not the v0.6.x advisory posture.

Serializes as omitted when None so a round-tripped config without an explicit mode keeps the partial-config shape for the next loader.

rules: Vec<PermissionRule>

v0.7.0 K9 — declarative permission rules. Each entry is a (namespace_pattern, op, agent_pattern, decision) tuple consulted by crate::permissions::Permissions::evaluate before the mode default falls through. Defaults to empty (no declarative rules — pre-K9 behaviour: mode + hooks + existing governance gate decide everything).

Trait Implementations

impl Clone for PermissionsConfig

fn clone(&self) -> PermissionsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionsConfig

fn default() -> PermissionsConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PermissionsConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PermissionsConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.