Struct PermissionRule 

pub struct PermissionRule {
    pub namespace_pattern: String,
    pub op: String,
    pub agent_pattern: String,
    pub decision: RuleDecision,
    pub reason: Option<String>,
}

One row of [[permissions.rules]] from config.toml.

Wire format:

[[permissions.rules]]
namespace_pattern = "secrets/*"
op               = "memory_store"
agent_pattern    = "ai:*"
decision         = "deny"
reason           = "ai agents may not write to secrets"

namespace_pattern and agent_pattern use a tiny glob vocabulary: * matches any run of non-/ characters in the namespace, any run of any character in the agent id. ** matches across / boundaries. An exact string is treated as a literal match.

op is required and matches the Op::as_str wire form. A missing op fails the loader.

Pattern specificity (longer literal-prefix wins) is the tie breaker when multiple rules match the same context — the rule whose namespace_pattern has the longest non-glob prefix takes precedence. Within equal namespace specificity, an exact agent_pattern (no *) beats a wildcard.

Fields

namespace_pattern: String

op: String

agent_pattern: String

decision: RuleDecision

reason: Option<String>

Trait Implementations

impl Clone for PermissionRule

fn clone(&self) -> PermissionRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PermissionRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for PermissionRule

fn eq(&self, other: &PermissionRule) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for PermissionRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PermissionRule