Skip to main content

default_rules

clawft_kernel::workload_governance::policy

Function default_rules 

Source 
pub fn default_rules() -> Vec<GovernanceRule>
Expand description

The workload rules shipped in the governance rule set.

  • DEFAULT_DENY_RULE_ID: blocks every workload.* action regardless of effect magnitude (force_on_match). This closes the gap where CapabilityGate and a plain GovernanceGate permit unknown actions.
  • EFFECT_CEILING_RULE_ID: blocks a workload.* action whose effect magnitude exceeds the engine threshold, even when a permit rule matched.

Both are ordinary GovernanceRules, so they travel through crate::rule_distribution::RuleDistribution like any other rule.