Enum Decision 

pub enum Decision {
    Allow {
        reason: String,
    },
    Deny {
        reason: String,
    },
    Indeterminate {
        reason: String,
    },
}

Result of an authorization policy evaluation.

Three-valued logic allows distinguishing between:

• Explicit allow (requirements met)
• Explicit deny (requirements violated)
• Cannot determine (missing information)

This is important for fail-safe behavior: Indeterminate should typically be treated as Deny unless the policy explicitly allows pass-through.

Variants

Allow

Authorization granted.

All requirements were checked and met. The action may proceed.

Fields

reason: String

Human-readable explanation of why authorization was granted.

Deny

Authorization denied.

A specific requirement was violated. The action must not proceed.

Fields

reason: String

Human-readable explanation of why authorization was denied.

Indeterminate

Cannot determine authorization.

Required information was missing or invalid. This is NOT the same as Deny - it indicates the policy engine couldn’t make a decision.

Callers should typically treat this as Deny for fail-safe behavior.

Fields

reason: String

Human-readable explanation of why a decision couldn’t be made.

Implementations

impl Decision

pub fn allow(reason: impl Into<String>) -> Self

Create an Allow decision with the given reason.

pub fn deny(reason: impl Into<String>) -> Self

Create a Deny decision with the given reason.

pub fn indeterminate(reason: impl Into<String>) -> Self

Create an Indeterminate decision with the given reason.

pub fn is_allowed(&self) -> bool

Returns true if this is an Allow decision.

pub fn is_denied(&self) -> bool

Returns true if this is a Deny decision.

pub fn is_indeterminate(&self) -> bool

Returns true if this is an Indeterminate decision.

pub fn reason(&self) -> &str

Returns the reason string for this decision.

pub fn is_allowed_fail_safe(&self) -> bool

Treat Indeterminate as Deny for fail-safe behavior.

This is the recommended way to convert a Decision to a boolean in security-sensitive contexts.

Trait Implementations

impl Clone for Decision

fn clone(&self) -> Decision

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Decision

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Decision

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for Decision

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Decision

fn eq(&self, other: &Decision) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Decision

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Decision

impl StructuralPartialEq for Decision