Struct PolicySet 

pub struct PolicySet {
    pub allow_capabilities: Vec<Capability>,
    pub gate_capabilities: Vec<Capability>,
    pub max_tool_runtime_secs: u64,
    pub max_events_per_turn: u64,
}

A set of policy rules governing agent capabilities.

Fields

allow_capabilities: Vec<Capability>

gate_capabilities: Vec<Capability>

max_tool_runtime_secs: u64

max_events_per_turn: u64

Implementations

impl PolicySet

pub fn anonymous() -> Self

Heavily restricted — anonymous public users. No side-effecting capabilities.

Shell execution (exec:cmd:*) is NOT gated (approval queue) — it is absent from both allow_capabilities and gate_capabilities, so the policy engine immediately denies any bash/shell tool call without creating an approval ticket. BRO-216.

5 events/turn, 30s tool runtime.

pub fn free() -> Self

Read + network + limited shell — authenticated free tier users.

Shell execution is restricted to a safe read-only whitelist; unlisted commands are denied immediately (not gated). BRO-216.

15 events/turn, 30s tool runtime.

pub fn pro() -> Self

Full access — authenticated Pro subscribers. 50 events/turn, 60s tool runtime.

pub fn enterprise() -> Self

Fully permissive — Enterprise tenants (custom overrides applied separately). 200 events/turn, 120s tool runtime.

Trait Implementations

impl Clone for PolicySet

fn clone(&self) -> PolicySet

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicySet

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PolicySet

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PolicySet

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PolicySet

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.