Enum Expr 

#[non_exhaustive]
pub enum Expr {
    True,
    False,
    And(Vec<Expr>),
    Or(Vec<Expr>),
    Not(Box<Expr>),
    HasCapability(String),
    HasAllCapabilities(Vec<String>),
    HasAnyCapability(Vec<String>),
    IssuerIs(String),
    IssuerIn(Vec<String>),
    SubjectIs(String),
    DelegatedBy(String),
    NotRevoked,
    NotExpired,
    ExpiresAfter(i64),
    IssuedWithin(i64),
    RoleIs(String),
    RoleIn(Vec<String>),
    RepoIs(String),
    RepoIn(Vec<String>),
    RefMatches(String),
    PathAllowed(Vec<String>),
    EnvIs(String),
    EnvIn(Vec<String>),
    WorkloadIssuerIs(String),
    WorkloadClaimEquals {
        key: String,
        value: String,
    },
    IsAgent,
    IsHuman,
    IsWorkload,
    MaxChainDepth(u32),
    AttrEquals {
        key: String,
        value: String,
    },
    AttrIn {
        key: String,
        values: Vec<String>,
    },
    MinAssurance(String),
    AssuranceLevelIs(String),
    ApprovalGate {
        inner: Box<Expr>,
        approvers: Vec<String>,
        ttl_seconds: u64,
        scope: Option<String>,
    },
}

Serializable policy expression.

This is the wire format stored in JSON/TOML files. All identifiers are strings. Must be compiled to CompiledPolicy before evaluation. Compilation validates and canonicalizes all string fields.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

True

Always allow.

False

Always deny.

And(Vec<Expr>)

All children must evaluate to Allow.

Or(Vec<Expr>)

At least one child must evaluate to Allow.

Not(Box<Expr>)

Invert the child’s outcome.

HasCapability(String)

Subject must have this capability.

HasAllCapabilities(Vec<String>)

Subject must have all listed capabilities.

HasAnyCapability(Vec<String>)

Subject must have at least one of the listed capabilities.

IssuerIs(String)

Issuer DID must match exactly.

IssuerIn(Vec<String>)

Issuer DID must be in the set.

SubjectIs(String)

Subject DID must match exactly.

DelegatedBy(String)

Attestation must be delegated by this DID.

NotRevoked

Attestation must not be revoked.

NotExpired

Attestation must not be expired.

ExpiresAfter(i64)

Attestation must have at least this many seconds remaining.

IssuedWithin(i64)

Attestation must have been issued within this many seconds.

RoleIs(String)

Subject’s role must match exactly.

RoleIn(Vec<String>)

Subject’s role must be in the set.

RepoIs(String)

Repository must match exactly.

RepoIn(Vec<String>)

Repository must be in the set.

RefMatches(String)

Git ref must match the glob pattern.

PathAllowed(Vec<String>)

All paths must match at least one of the glob patterns.

EnvIs(String)

Environment must match exactly.

EnvIn(Vec<String>)

Environment must be in the set.

WorkloadIssuerIs(String)

Workload issuer DID must match exactly.

WorkloadClaimEquals

Workload claim must equal the expected value.

Fields

key: String

Claim key (alphanumeric + underscore only).

value: String

Expected value.

IsAgent

Signer must be an AI agent.

IsHuman

Signer must be a human.

IsWorkload

Signer must be a workload (CI/CD).

MaxChainDepth(u32)

Delegation chain depth must not exceed this value.

AttrEquals

Match a flat string attribute. Keys must be alphanumeric+underscore, max 64 chars. No dot-paths. No nested JSON. No Value type.

Fields

key: String

Attribute key (alphanumeric + underscore only).

value: String

Expected value.

AttrIn

Attribute must be one of the values.

Fields

key: String

Attribute key (alphanumeric + underscore only).

values: Vec<String>

Allowed values.

MinAssurance(String)

Assurance level must be at least this level (uses Ord comparison).

AssuranceLevelIs(String)

Assurance level must match exactly.

ApprovalGate

Approval gate: if inner evaluates to Allow, return RequiresApproval instead. Transparent to Deny/Indeterminate — those pass through unchanged.

Fields

inner: Box<Expr>

The inner expression to evaluate.

approvers: Vec<String>

DIDs of allowed approvers (validated at compile time).

ttl_seconds: u64

Approval request TTL in seconds (default 300 = 5 minutes).

scope: Option<String>

Approval scope: “identity” (default), “scoped”, or “full”.

Implementations

impl Expr

pub fn and(conditions: impl IntoIterator<Item = Expr>) -> Self

Create an And expression from multiple conditions.

pub fn or(conditions: impl IntoIterator<Item = Expr>) -> Self

Create an Or expression from multiple conditions.

pub fn negate(expr: Expr) -> Self

Create a Not expression (negation).

Trait Implementations

impl Clone for Expr

fn clone(&self) -> Expr

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Expr

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Expr

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Expr

fn eq(&self, other: &Expr) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Expr

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Expr