Enum PermissionTier 

pub enum PermissionTier {
    ReadOnly,
    SandboxEdit,
    FullAccess,
}

Permission tiers — who may authorize this action? — ordered by the authority an action demands (survey §3.4.3). The Ord derive makes ReadOnly < SandboxEdit < FullAccess, so “does the granted tier cover the required tier?” is a single >=.

This ladder does not answer “can it be undone?”

It used to read as though it did. SandboxEdit was documented as “reversible local mutation” and FullAccess as “externally-consequential or irreversible”, and that or quietly fused two independent questions onto one rung: a git push, a production INSERT, and a charged card are all FullAccess and have three different rollback contracts. Collapsed, the runtime had two options and no third — gate every FullAccess action identically (approval fatigue, and the predictable response is that someone turns the gate off), or relax the tier and lose the permanent cases along with the recoverable ones.

The rollback contract is now car_ir::Reversibility, classified by classify_reversibility from its own keyword sets, and the two axes are reported side by side. Nothing about this enum changed when that axis landed — not its ordering, not its variants, not what RiskClassifier::classify returns for any action. Only this documentation changed, because it had been describing the other axis.

Variants

ReadOnly

Observation only — state reads, retrieval, static inspection, log analysis. Nothing is mutated, so the only authority at stake is the authority to look.

SandboxEdit

Mutation whose blast radius stops at the session’s own workspace — state writes, local patches, sandboxed tool calls, temporary dependency installs inside an isolated workspace. Authorizable by a standing grant precisely because nothing crosses the sandbox boundary.

FullAccess

Externally consequential — effects that cross the sandbox boundary: network egress, credentials/secrets, deployment, destructive filesystem or VCS operations, financial/medical actions, physical control. Needs the top standing grant and, by default (require_approval_at), a human decision as well.

Whether such an action can afterwards be undone is a separate question this rung does not answer: it holds read_secret (nothing to undo), git push (force-push the prior ref), and a charged card (no undo at all) alike. Ask classify_reversibility for that.

Implementations

impl PermissionTier

pub fn covers(self, required: PermissionTier) -> bool

Does a session granted self cover an action requiring required?

pub fn as_str(self) -> &'static str

pub fn from_str_opt(s: &str) -> Option<PermissionTier>

Trait Implementations

impl Clone for PermissionTier

fn clone(&self) -> PermissionTier

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PermissionTier

impl Debug for PermissionTier

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PermissionTier

fn deserialize<__D>( __deserializer: __D, ) -> Result<PermissionTier, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PermissionTier

impl Hash for PermissionTier

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for PermissionTier

fn cmp(&self, other: &PermissionTier) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for PermissionTier

fn eq(&self, other: &PermissionTier) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for PermissionTier

fn partial_cmp(&self, other: &PermissionTier) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for PermissionTier

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PermissionTier