Struct WorkloadPermitRule 

pub struct WorkloadPermitRule {

    pub id: String,
    pub description: String,
    pub actions: Vec<String>,
    pub kinds: Vec<String>,
    pub min_package_trust: PackageTrust,
    pub min_node_tier: NodeTrustTier,
    pub max_network: NetworkPolicy,
    pub allow_secrets: bool,
    pub allow_emulated: bool,
    pub accelerators: Vec<String>,
    pub max_resource_cost: f64,
    pub projects: Vec<String>,
    pub principals: Vec<String>,
}

An explicit allowance that lifts the workload.* default deny.

Every condition must hold. Defaults are the strict ones from ADR-099 section 8: pinned signer, paired node, LAN at most, no secrets, no emulation, no accelerator.

Fields

id: String

Unique id (recorded in the chain event when it matches).

description: String

Why this permit exists.

actions: Vec<String>

Action selectors (workload.place, or workload.*).

kinds: Vec<String>

Workload kinds allowed (cog, inference; * for any).

min_package_trust: PackageTrust

Least package trust allowed.

min_node_tier: NodeTrustTier

Least node trust tier allowed.

max_network: NetworkPolicy

Most network exposure allowed.

allow_secrets: bool

Whether secrets may be delivered.

allow_emulated: bool

Whether emulated placement is allowed (operator opt-in).

accelerators: Vec<String>

Accelerator id selectors allowed (accel.gpu.*). Empty: none.

max_resource_cost: f64

Highest resource cost allowed.

projects: Vec<String>

Verified project ids this permit applies to (ADR-103 A6). Empty: any. Matched against the gate’s verified attestation, never against anything the request carries; with a non-empty list and no verified project the rule does not match.

principals: Vec<String>

Principals (the gate’s agent_id) this permit applies to. Empty: any. With a non-empty list a request whose principal is unknown, or not listed, does not match. The project kind uses it to limit its permit to SUPERVISOR_PRINCIPAL.

Implementations

impl WorkloadPermitRule

pub fn new( id: impl Into<String>, actions: impl IntoIterator<Item = impl Into<String>>, kinds: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Strict permit for actions on workloads of kinds.

pub fn validate(&self) -> Result<(), String>

Reject rules that are empty, malformed, or reach outside workload.*.

pub fn matches(&self, action: &str, effect: &WorkloadEffect) -> bool

Whether this rule permits action with effect.

pub fn matches_in( &self, action: &str, effect: &WorkloadEffect, project: Option<&str>, ) -> bool

matches for a request attributed to project (the verified project id, or None outside any project).

pub fn matches_for( &self, action: &str, effect: &WorkloadEffect, project: Option<&str>, principal: Option<&str>, ) -> bool

matches_in for a request made by principal (the gate’s agent id; None when unknown, which never satisfies a rule that lists principals).

Trait Implementations

impl Clone for WorkloadPermitRule

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WorkloadPermitRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WorkloadPermitRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for WorkloadPermitRule

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for WorkloadPermitRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for WorkloadPermitRule