Struct Policy 

pub struct Policy {
    pub auto_apply_enabled: bool,
    pub auto_apply: Vec<AutoApplyGrant>,
    pub deny: Vec<String>,
    pub severity_floors: BTreeMap<String, Severity>,
    pub telemetry: TelemetryMode,
}

The parsed host policy. Everything default-closed.

Fields

auto_apply_enabled: bool

Master opt-in (same posture as allow_destructive_ops: default off). Auto-apply never fires unless this is true AND a grant matches.

auto_apply: Vec<AutoApplyGrant>

Auto-apply grants (default: none).

deny: Vec<String>

Analyzer families the host disables entirely.

severity_floors: BTreeMap<String, Severity>

Per-analyzer severity floors (family → floor); combined with the file’s floors by taking the stricter of the two.

telemetry: TelemetryMode

Implementations

impl Policy

pub fn from_json(s: &str) -> Result<Self>

Parse a policy JSON string. Unknown keys are rejected (fail-closed).

pub fn denies(&self, family: &str) -> bool

Is this analyzer family denied by the host?

pub fn severity_floor(&self, family: &str) -> Option<Severity>

The host severity floor for a family, if any.

pub fn grants_auto_apply( &self, family: &str, target_class: &str, severity: Severity, ) -> bool

Does a grant permit auto-applying this family to target_class at severity? Only the memory class is ever eligible.

query was eligible until definition rewrites became executable (issue #28). A grain edit changes one remembered value; a saved-query or template rewrite changes what EVERY future context contains — the blast radius is every turn from now on, not one fact. So a definition rewrite always requires a human APPROVE + APPLY with BECAUSE, and the class is excluded here by name, exactly as code/evalset are.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Policy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Policy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Policy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.