Enum CompiledExpr 

#[non_exhaustive]
pub enum CompiledExpr {
    True,
    False,
    And(Vec<CompiledExpr>),
    Or(Vec<CompiledExpr>),
    Not(Box<CompiledExpr>),
    HasCapability(CanonicalCapability),
    HasAllCapabilities(Vec<CanonicalCapability>),
    HasAnyCapability(Vec<CanonicalCapability>),
    IssuerIs(CanonicalDid),
    IssuerIn(Vec<CanonicalDid>),
    SubjectIs(CanonicalDid),
    DelegatedBy(CanonicalDid),
    NotRevoked,
    NotExpired,
    ExpiresAfter(i64),
    IssuedWithin(i64),
    RoleIs(String),
    RoleIn(Vec<String>),
    RepoIs(String),
    RepoIn(Vec<String>),
    RefMatches(ValidatedGlob),
    PathAllowed(Vec<ValidatedGlob>),
    EnvIs(String),
    EnvIn(Vec<String>),
    WorkloadIssuerIs(CanonicalDid),
    WorkloadClaimEquals {
        key: String,
        value: String,
    },
    IsAgent,
    IsHuman,
    IsWorkload,
    MaxChainDepth(u32),
    AttrEquals {
        key: String,
        value: String,
    },
    AttrIn {
        key: String,
        values: Vec<String>,
    },
    MinAssurance(AssuranceLevel),
    AssuranceLevelIs(AssuranceLevel),
    ApprovalGate {
        inner: Box<CompiledExpr>,
        approvers: Vec<CanonicalDid>,
        ttl_seconds: u64,
        scope: ApprovalScope,
    },
}

Compiled policy expression — validated, canonical, ready to evaluate.

Constructed only via compile. Cannot be built directly. All string fields have been parsed into canonical typed forms.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

True

Always allow.

False

Always deny.

And(Vec<CompiledExpr>)

All children must evaluate to Allow.

Or(Vec<CompiledExpr>)

At least one child must evaluate to Allow.

Not(Box<CompiledExpr>)

Invert the child’s outcome.

HasCapability(CanonicalCapability)

Subject must have this capability.

HasAllCapabilities(Vec<CanonicalCapability>)

Subject must have all listed capabilities.

HasAnyCapability(Vec<CanonicalCapability>)

Subject must have at least one of the listed capabilities.

IssuerIs(CanonicalDid)

Issuer DID must match exactly.

IssuerIn(Vec<CanonicalDid>)

Issuer DID must be in the set.

SubjectIs(CanonicalDid)

Subject DID must match exactly.

DelegatedBy(CanonicalDid)

Attestation must be delegated by this DID.

NotRevoked

Attestation must not be revoked.

NotExpired

Attestation must not be expired.

ExpiresAfter(i64)

Attestation must have at least this many seconds remaining.

IssuedWithin(i64)

Attestation must have been issued within this many seconds.

RoleIs(String)

Subject’s role must match exactly.

RoleIn(Vec<String>)

Subject’s role must be in the set.

RepoIs(String)

Repository must match exactly.

RepoIn(Vec<String>)

Repository must be in the set.

RefMatches(ValidatedGlob)

Git ref must match the glob pattern.

PathAllowed(Vec<ValidatedGlob>)

All paths must match at least one of the glob patterns.

EnvIs(String)

Environment must match exactly.

EnvIn(Vec<String>)

Environment must be in the set.

WorkloadIssuerIs(CanonicalDid)

Workload issuer DID must match exactly.

WorkloadClaimEquals

Workload claim must equal the expected value.

Fields

key: String

Claim key.

value: String

Expected value.

IsAgent

Signer must be an AI agent.

IsHuman

Signer must be a human.

IsWorkload

Signer must be a workload (CI/CD).

MaxChainDepth(u32)

Delegation chain depth must not exceed this value.

AttrEquals

Match a flat string attribute.

Fields

key: String

Attribute key.

value: String

Expected value.

AttrIn

Attribute must be one of the values.

Fields

key: String

Attribute key.

values: Vec<String>

Allowed values.

MinAssurance(AssuranceLevel)

Assurance level must be at least this level (uses Ord comparison).

AssuranceLevelIs(AssuranceLevel)

Assurance level must match exactly.

ApprovalGate

Approval gate: if inner evaluates to Allow, return RequiresApproval.

Fields

inner: Box<CompiledExpr>

The compiled inner expression.

approvers: Vec<CanonicalDid>

Validated DIDs of allowed approvers.

ttl_seconds: u64

Approval request TTL in seconds.

scope: ApprovalScope

Approval scope controlling hash binding.

Trait Implementations

impl Clone for CompiledExpr

fn clone(&self) -> CompiledExpr

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CompiledExpr

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for CompiledExpr

fn eq(&self, other: &CompiledExpr) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for CompiledExpr