Struct PermissionCeiling 

pub struct PermissionCeiling {
    pub write: bool,
    pub network_tool: bool,
    pub shell: ShellCeiling,
    pub delegation_depth: u32,
    pub tools: bool,
}

The most a member is allowed to do. This is a ceiling, never a grant: PermissionCeiling::clamp_to can only ever narrow against the active session posture, so a saved Fleet can never raise live authority.

Fields

write: bool

network_tool: bool

Whether the member may be handed a model-visible network tool (fetch, browse, HTTP).

This is deliberately not a statement about transport. Host-owned provider inference — the ordinary API call CodeWhale makes on the member’s behalf — always happens over the network and is not governed by this field. A member with network_tool = false still runs on a remote model; it simply has no tool with which to reach the network itself. Receipts disclose that distinction rather than implying an air-gap.

shell: ShellCeiling

delegation_depth: u32

Nested-delegation budget this member may consume.

tools: bool

Whether the member may be handed tools at all.

Implementations

impl PermissionCeiling

pub const ROUTER: Self

The Router’s fixed posture: no tools (so no network tool), no shell, no writes, no delegation. Not configurable — see RouterMember.

The Router itself is still inferred by its configured provider over the network; that is host-owned transport, disclosed on the receipt.

pub fn preset(name: &str) -> Option<Self>

Named presets accepted by permissions = "<preset>".

pub fn clamp_to(self, session: Self) -> Self

Narrow this ceiling against the active session posture. Every field takes the more restrictive side, so the result can never grant more than either input.

Trait Implementations

impl Clone for PermissionCeiling

fn clone(&self) -> PermissionCeiling

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PermissionCeiling

impl Debug for PermissionCeiling

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionCeiling

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PermissionCeiling

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PermissionCeiling

impl PartialEq for PermissionCeiling

fn eq(&self, other: &PermissionCeiling) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PermissionCeiling

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PermissionCeiling