Struct GovernanceRule 

pub struct GovernanceRule {
    pub id: String,
    pub description: String,
    pub branch: GovernanceBranch,
    pub severity: RuleSeverity,
    pub active: bool,
    pub reference_url: Option<String>,
    pub sop_category: Option<String>,
    pub rule_type: GovernanceRuleType,
    pub action_selector: Option<String>,
    pub tool_selector: Option<String>,
    pub force_on_match: bool,
}

A governance rule that restricts agent behavior.

Fields

id: String

Unique rule identifier.

description: String

Human-readable rule description.

branch: GovernanceBranch

Which branch defined this rule.

severity: RuleSeverity

Rule severity (how critical the violation is).

active: bool

Whether this rule is currently active.

reference_url: Option<String>

SOP reference URL for agents to consult for full procedure.

sop_category: Option<String>

SOP category tag for filtering rules by domain.

rule_type: GovernanceRuleType

Rule type discriminator. Defaults to GovernanceRuleType::General.

Serde defaults missing fields so older chain-anchored rules remain valid.

action_selector: Option<String>

Optional action selector (WEFT-634).

When set, the rule only applies when the request’s action matches. Matching is exact, or prefix when the selector ends with * (e.g. "tool.agent_*" matches "tool.agent_spawn"). None / empty means “match any action” (magnitude-only rules).

tool_selector: Option<String>

Optional tool selector (WEFT-634).

When set, the rule only applies when the request context key "tool" (or fallback "gate_action") matches. Same exact/prefix semantics as Self::action_selector. None means “any tool”.

force_on_match: bool

When true, a selector-matching General rule applies its severity without requiring effect magnitude to exceed the threshold (WEFT-634 / WEFT-633 spawn-approval foundation).

Magnitude-only rules leave this false (default) so behaviour is backward-compatible. BrowserPolicy / BindingThread paths already ignore magnitude and do not consult this flag.

Implementations

impl GovernanceRule

pub fn filter_by_category<'a>( rules: &'a [GovernanceRule], category: &str, ) -> Vec<&'a GovernanceRule>

Get rules by SOP category from a slice of rules.

pub fn filter_by_type<'a>( rules: &'a [GovernanceRule], rule_type: &GovernanceRuleType, ) -> Vec<&'a GovernanceRule>

Get rules of a given type from a slice of rules.

pub fn selectors_match(&self, request: &GovernanceRequest) -> bool

Whether this rule’s action/tool selectors match request (WEFT-634).

• No selectors set → always matches (magnitude-only rule).
• Action selector: matches request.action.
• Tool selector: matches context["tool"], else context["gate_action"].
• Both set → both must match (AND).

pub fn browser_policy( id: impl Into<String>, description: impl Into<String>, ) -> Self

Build a blocking browser_policy rule (S7 / WEFT-108).

pub fn binding_thread(description: impl Into<String>) -> Self

Build the binding-thread integrity rule (WEFT-342).

Rule id is the governance action name BINDING_THREAD_RULE_ID (soul.binding_thread_intact).

pub fn spawn_requires_approval() -> Self

Build the spawn-approval rule (WEFT-633 foundation).

Matches tool.agent_spawn / tool context agent_spawn and forces a blocking decision independent of effect magnitude so the gate maps to GovernanceDecision::EscalateToHuman → crate::gate::GateDecision::Defer when the engine has human_approval_required. Without human approval, the decision is a hard deny (operator must grant via exemption or lower severity).

Trait Implementations

impl Clone for GovernanceRule

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GovernanceRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for GovernanceRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for GovernanceRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.