Struct SecurityPolicyLayer 

pub struct SecurityPolicyLayer { /* private fields */ }

Carrier-only authorization layer (ADR-0061 Task 2.9 strict mode).

The layer NEVER authenticates: transports mint the typed carrier at the request boundary (kernel_authenticate + install_carrier) and the pre-pipeline dispatch check rejects carrier-less Exchanges on non-Public routes before the pipeline runs. The layer therefore sees an Exchange that already carries the sealed [AuthenticatedPrincipal] and only evaluates the route policy against it — no carrier, no authorization path (fail closed). The Phase-1 legacy Bearer and anonymous-principal branches were deleted here.

Implementations

impl SecurityPolicyLayer

pub fn new(policy: Arc<dyn SecurityPolicy>, transport: TransportId) -> Self

Trait Implementations

impl Clone for SecurityPolicyLayer

fn clone(&self) -> SecurityPolicyLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S> Layer<S> for SecurityPolicyLayer

type Service = SecurityPolicyService<S>

The wrapped service

fn layer(&self, inner: S) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.