Skip to main content

GateBackend

clawft_kernel::gate

Trait GateBackend 

Source 
pub trait GateBackend: Send + Sync {
    // Required method
    fn check(
        &self,
        agent_id: &str,
        action: &str,
        context: &Value,
    ) -> GateDecision;

    // Provided methods
    fn check_teardown(
        &self,
        agent_id: &str,
        action: &str,
        context: &Value,
    ) -> GateDecision { ... }
    fn governance_snapshot(&self) -> Option<GovernanceSnapshot> { ... }
}
Expand description

Trait for gate backends that make access-control decisions.

Implementations include:

  • CapabilityGate — wraps the existing CapabilityChecker for binary Permit/Deny decisions.
  • TileZeroGate (behind tilezero feature) — three-way Permit/Defer/Deny with cryptographic receipts.

Required Methods§

Source

fn check(&self, agent_id: &str, action: &str, context: &Value) -> GateDecision

Check whether an agent is allowed to perform an action.

§Arguments
  • agent_id - The agent requesting the action.
  • action - The action being attempted (e.g. “tool.shell_exec”, “ipc.send”, “service.access”).
  • context - Additional context for the decision (tool args, target PID, etc.).

Provided Methods§

Source

fn check_teardown( &self, agent_id: &str, action: &str, context: &Value, ) -> GateDecision

Self::check for a teardown (stop / unload / re-adoption of what is already placed): a denial caused only by the node’s trust tier is waived, every other denial (revocation, default deny, rule or threshold) stands. Gates that cannot tell the difference return the plain decision, so they never waive anything.

Source

fn governance_snapshot(&self) -> Option<GovernanceSnapshot>

The rules and settings this gate evaluates with, when it is backed by a governance engine. The user daemon exports it as the signed parent policy for its project kernels (ADR-103 D8). None for gates with no rule set.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§