Struct EvaluateInput 

pub struct EvaluateInput<'a> {
    pub request: &'a PortableToolCallRequest,
    pub capability: &'a CapabilityToken,
    pub trusted_issuers: &'a [PublicKey],
    pub clock: &'a dyn Clock,
    pub guards: &'a [&'a dyn Guard],
    pub session_filesystem_roots: Option<&'a [String]>,
}

Inputs to evaluate. Grouped into a struct so the call site stays tidy and future fields (e.g. a policy-digest override) can be added without breaking the public signature.

Fields

request: &'a PortableToolCallRequest

Tool call request being evaluated.

capability: &'a CapabilityToken

The capability token authorising this call.

trusted_issuers: &'a [PublicKey]

Trusted issuer public keys (typically CA + kernel + authority).

clock: &'a dyn Clock

Clock used for time-bound enforcement.

guards: &'a [&'a dyn Guard]

Guard pipeline. Evaluated in order, fail-closed on deny or error.

session_filesystem_roots: Option<&'a [String]>

Optional filesystem roots from the owning session, passed through to guards that enforce root-based resource protection.