Struct CapabilityChecker 

pub struct CapabilityChecker { /* private fields */ }

Capability checker that enforces per-agent access control.

The checker reads capabilities from the process table and validates tool access, IPC routing, service access, and resource limits. It is designed to be called from tool execution hooks without requiring a direct dependency on the kernel crate (via trait objects in the core).

Implementations

impl CapabilityChecker

pub fn new(process_table: Arc<ProcessTable>) -> Self

Create a new capability checker backed by the given process table.

pub fn check_tool_access( &self, pid: Pid, tool_name: &str, tool_permissions: Option<&ToolPermissions>, sandbox: Option<&SandboxPolicy>, ) -> Result<(), KernelError>

Check whether a process is allowed to call a tool.

Evaluation order:

1. Agent must have can_exec_tools enabled.
2. If tool_permissions.deny is non-empty, the tool must not be in the deny list (deny overrides allow).
3. If tool_permissions.allow is non-empty, the tool must be in the allow list.
4. Shell tools require sandbox.allow_shell.

Errors

Returns KernelError::CapabilityDenied with a description of why access was denied.

pub fn check_ipc_target( &self, from_pid: Pid, to_pid: Pid, ) -> Result<(), KernelError>

Check whether a process may send a message to another process.

Uses the sender’s IPC scope to determine if communication with the target PID is allowed.

Errors

Returns KernelError::CapabilityDenied if IPC is disabled or the target is outside the sender’s IPC scope.

pub fn check_ipc_topic(&self, pid: Pid, topic: &str) -> Result<(), KernelError>

Check whether a process may publish or subscribe to a topic.

Errors

Returns KernelError::CapabilityDenied if the agent’s IPC scope does not permit the given topic.

pub fn check_service_access( &self, pid: Pid, service_name: &str, tool_permissions: Option<&ToolPermissions>, ) -> Result<(), KernelError>

Check whether a process may access a named service.

If tool_permissions has a non-empty service_access list, the service name must appear in it.

Errors

Returns KernelError::CapabilityDenied if the service is not in the agent’s service access list.

pub fn check_resource_limit( &self, pid: Pid, resource: &ResourceType, ) -> Result<(), KernelError>

Check whether a resource usage is within the agent’s limits.

Errors

Returns KernelError::ResourceLimitExceeded if the resource usage exceeds the agent’s configured limits.

pub fn process_table(&self) -> &Arc<ProcessTable>

Get a reference to the underlying process table.