Struct CapabilityGate 

pub struct CapabilityGate { /* private fields */ }

Gate backend wrapping the existing CapabilityChecker.

Always returns Permit or Deny (never Defer). This is the default gate used when no external gate crate is enabled.

Implementations

impl CapabilityGate

pub fn new(process_table: Arc<ProcessTable>) -> Self

Create a capability gate backed by the given process table.

Trait Implementations

impl GateBackend for CapabilityGate

fn check(&self, _agent_id: &str, action: &str, context: &Value) -> GateDecision

Check whether an agent is allowed to perform an action.

fn check_teardown( &self, agent_id: &str, action: &str, context: &Value, ) -> GateDecision

Self::check for a teardown (stop / unload / re-adoption of what is already placed): a denial caused only by the node’s trust tier is waived, every other denial (revocation, default deny, rule or threshold) stands. Gates that cannot tell the difference return the plain decision, so they never waive anything.

fn governance_snapshot(&self) -> Option<GovernanceSnapshot>

The rules and settings this gate evaluates with, when it is backed by a governance engine. The user daemon exports it as the signed parent policy for its project kernels (ADR-103 D8). None for gates with no rule set.