pub struct PolicySimulationResult {
pub action: PolicySimulationResultAction,
pub evaluated_policies: Vec<EvaluatedPolicy>,
pub evaluated_unit: Option<EvaluatedUnit>,
pub matched_rule: Option<MatchedPolicyRule>,
pub reason: PolicySimulationResultReason,
pub unmatched_rules: Vec<UnmatchedPolicyRule>,
}Expand description
The action the real operation would take and why. matchedRule is present exactly when reason is rule_accepted or rule_rejected.
JSON schema
{
"description": "The action the real operation would take and why. `matchedRule` is present exactly when `reason` is `rule_accepted` or `rule_rejected`.",
"examples": [
{
"action": "reject",
"evaluatedPolicies": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"scope": "project",
"updatedAt": "2026-09-01T12:00:00Z"
}
],
"reason": "no_rule_matched",
"unmatchedRules": [
{
"criterion": {
"ethValue": "1",
"operator": "<=",
"type": "ethValue"
},
"criterionIndex": 0,
"observed": {
"ethValue": "500000000000000000",
"type": "ethValue"
},
"policy": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"scope": "project",
"updatedAt": "2026-09-01T12:00:00Z"
},
"ruleIndex": 0
}
]
}
],
"type": "object",
"required": [
"action",
"evaluatedPolicies",
"reason",
"unmatchedRules"
],
"properties": {
"action": {
"description": "Whether the real operation would be accepted or rejected.",
"examples": [
"reject"
],
"type": "string",
"enum": [
"accept",
"reject"
],
"x-go-type": "string"
},
"evaluatedPolicies": {
"description": "Policies iterated, in order: the project policy, then the account policy. Evaluation stops at the policy containing `matchedRule`. End-user operations consult only the project policy.",
"type": "array",
"items": {
"$ref": "#/components/schemas/EvaluatedPolicy"
}
},
"evaluatedUnit": {
"$ref": "#/components/schemas/EvaluatedUnit"
},
"matchedRule": {
"$ref": "#/components/schemas/MatchedPolicyRule"
},
"reason": {
"description": "Why the operation got its `action`. Each value implies exactly one `action`.\nWithin a policy, a matching `reject` rule overrides any matching `accept` rule, regardless of rule order.\nWith `accept`: `rule_accepted` means `matchedRule` matched all of its criteria, its action is `accept`, and no `reject` rule in the same policy matched. `no_rule_for_operation` means no rule targeted the operation, so it was accepted by default.\nWith `reject`: `rule_rejected` means `matchedRule` matched all of its criteria and its action is `reject`, so the rejection is caused by the entire rule. `no_rule_matched` means at least one rule targeted the operation but none matched, so it was rejected by default; `unmatchedRules` shows the criterion that disqualified each one.",
"examples": [
"no_rule_matched"
],
"type": "string",
"enum": [
"rule_accepted",
"rule_rejected",
"no_rule_matched",
"no_rule_for_operation"
]
},
"unmatchedRules": {
"description": "Rules targeting the operation that were evaluated and did not match. Within a policy, `reject` rules are evaluated before `accept` rules, and evaluation stops at `matchedRule`. Rules that were not evaluated are omitted. When there is no `matchedRule`, every rule that targeted the operation appears here. Among matching rules with the same action, the first in policy order is `matchedRule`.",
"type": "array",
"items": {
"$ref": "#/components/schemas/UnmatchedPolicyRule"
}
}
}
}Fields§
§action: PolicySimulationResultActionWhether the real operation would be accepted or rejected.
evaluated_policies: Vec<EvaluatedPolicy>Policies iterated, in order: the project policy, then the account policy. Evaluation stops at the policy containing matchedRule. End-user operations consult only the project policy.
evaluated_unit: Option<EvaluatedUnit>§matched_rule: Option<MatchedPolicyRule>§reason: PolicySimulationResultReasonWhy the operation got its action. Each value implies exactly one action.
Within a policy, a matching reject rule overrides any matching accept rule, regardless of rule order.
With accept: rule_accepted means matchedRule matched all of its criteria, its action is accept, and no reject rule in the same policy matched. no_rule_for_operation means no rule targeted the operation, so it was accepted by default.
With reject: rule_rejected means matchedRule matched all of its criteria and its action is reject, so the rejection is caused by the entire rule. no_rule_matched means at least one rule targeted the operation but none matched, so it was rejected by default; unmatchedRules shows the criterion that disqualified each one.
unmatched_rules: Vec<UnmatchedPolicyRule>Rules targeting the operation that were evaluated and did not match. Within a policy, reject rules are evaluated before accept rules, and evaluation stops at matchedRule. Rules that were not evaluated are omitted. When there is no matchedRule, every rule that targeted the operation appears here. Among matching rules with the same action, the first in policy order is matchedRule.