pub enum FilesystemDecision {
Read,
Write,
Deny,
ExternallyEnforced,
}Expand description
The result of evaluating a filesystem request against a policy.
ExternallyEnforced is intentionally distinct from AccessMode::Deny.
It tells a backend that Cageforge does not make the local decision because
another trusted sandbox owns the filesystem boundary.
This type intentionally does not implement Ord. Local access decisions
and external ownership are not one total permission ordering; callers must
handle ExternallyEnforced explicitly instead of combining decisions with
min or max.
Variants§
Read
Permit reads but not modifications.
Write
Permit reads and modifications.
Deny
Permit neither reads nor modifications.
ExternallyEnforced
Defer enforcement to the trusted external sandbox.
Implementations§
Source§impl FilesystemDecision
impl FilesystemDecision
Sourcepub const fn as_access_mode(self) -> Option<AccessMode>
pub const fn as_access_mode(self) -> Option<AccessMode>
Returns the local access mode, or None when another sandbox enforces it.
Sourcepub const fn is_externally_enforced(self) -> bool
pub const fn is_externally_enforced(self) -> bool
Returns whether local filesystem enforcement is delegated elsewhere.