Struct DecisionRecord 

pub struct DecisionRecord {
    pub generation: u64,
    pub op: Op,
    pub key: String,
    pub actor_kind: String,
    pub actor_id: String,
    pub authenticated_by: Vec<String>,
    pub presenter_kind: String,
    pub presenter_id: String,
    pub outcome: Outcome,
    pub reason: String,
}

A structured record of one authorization decision (the audit hook point).

Built from a Decision plus the request’s (subject, op, key) and presenter context. It carries everything the audit sink needs to serialize a JSONL audit line and nothing secret: no payloads, no key bytes, no signatures.

Fields

generation: u64

The id of the policy generation this decision was made against (basil-y3e). Lets the audit trail tie a decision to the exact catalog/policy snapshot that produced it across a hot reload.

op: Op

The op that was gated (the policy Op, e.g. sign, new_key).

key: String

The dotted catalog key the op targeted.

actor_kind: String

Actor kind. M1 authorization records are subject-based.

actor_id: String

The policy subject being authorized.

authenticated_by: Vec<String>

Evidence summaries that established the actor.

presenter_kind: String

Presenter kind, e.g. unix_peercred.

presenter_id: String

Presenter id, preferably the configured name(uid) label.

outcome: Outcome

Allow or deny.

reason: String

On an allow, what granted it (subject / public-class); on a deny, which check failed (unknown-key / not-writable / not-permitted). Always a short stable token, never secret.

Implementations

impl DecisionRecord

pub fn from_actor_decision( generation: u64, actor: &AuthenticatedActor, op: Op, key: &str, decision: &Decision, ) -> Self

Build a record from a PDP Decision for an AuthenticatedActor.

pub fn from_resolution_error( generation: u64, peer: &PeerInfo, op: Op, key: &str, reason: String, ) -> Self

Build a denied record for a request whose presenter could not resolve to a subject.

pub fn record(&self)

Emit this record to the tracing log (the in-handler audit hook).

Allows log at info, denials at warn. vault-vq5 will tap the same records to append a JSONL audit line; this method is intentionally the only side effect today.

Trait Implementations

impl Clone for DecisionRecord

fn clone(&self) -> DecisionRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DecisionRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for DecisionRecord

impl PartialEq for DecisionRecord

fn eq(&self, other: &DecisionRecord) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for DecisionRecord