Crate arbiter 

arbiter

Cedar-based policy enforcement as Suggestors for the Converge Engine.

Policy gates participate INSIDE the convergence loop — they evaluate proposals against Cedar policies and write constraints for violations.

Usage

use arbiter::{PolicyGateSuggestor, PolicyEngine};
use std::sync::Arc;

let engine = PolicyEngine::from_policy_str(EXPENSE_APPROVAL_POLICY)?;
let gate = PolicyGateSuggestor::new(Arc::new(engine));
converge_engine.register_suggestor(gate);

Available Suggestors

• PolicyGateSuggestor — Cedar policy evaluation
• DelegationVerifySuggestor — Ed25519 delegation chain verification
• FlowGateSuggestor — Flow-level authorization gates
• CedarHitlGateSuggestor — named strict Cedar-backed HITL gate for Formations

Re-exports

pub use engine::PolicyEngine;

pub use formation::ANALYSIS_EVIDENCE_CAPABILITY_ID;

pub use formation::ARBITER_FORMATION_CAPABILITIES;

pub use formation::ARBITER_FORMATION_PACK_ID;

pub use formation::ArbiterFormationCapability;

pub use formation::ArbiterFormationCapabilityKind;

pub use formation::HITL_GATE_CAPABILITY_ID;

pub use formation::POLICY_GATE_CAPABILITY_ID;

pub use formation::find_formation_capability;

pub use formation::formation_capabilities;

pub use primitives::Confidence;

pub use primitives::CostUsd;

pub use primitives::EpochSeconds;

pub use primitives::ProposalCount;

pub use primitives::ProposalLimit;

pub use provenance::ARBITER_PROVENANCE;

pub use provenance::Arbiter;

pub use suggestor::ApprovalConstraintPayload;

pub use suggestor::ApprovalGateStatus;

pub use suggestor::ApprovalGateSuggestor;

pub use suggestor::ApprovalRiskPayload;

pub use suggestor::BudgetConstraintPayload;

pub use suggestor::BudgetGateSuggestor;

pub use suggestor::CedarHitlGateSuggestor;

pub use suggestor::ComplianceCondition;

pub use suggestor::ComplianceConstraintPayload;

pub use suggestor::ComplianceDocumentPayload;

pub use suggestor::ComplianceGateSuggestor;

pub use suggestor::ComplianceRule;

pub use suggestor::CostEstimatePayload;

pub use suggestor::DataClassificationConstraintPayload;

pub use suggestor::DataClassificationGateSuggestor;

pub use suggestor::DelegationVerificationPayload;

pub use suggestor::DelegationVerifySuggestor;

pub use suggestor::FlowGateSuggestor;

pub use suggestor::GateConstraintAction;

pub use suggestor::PolicyGateSuggestor;

pub use suggestor::RateLimitConstraintPayload;

pub use suggestor::RateLimitGateSuggestor;

pub use types::ContextIn;

pub use types::DecideRequest;

pub use types::PrincipalIn;

pub use types::ResourceIn;

pub use decision::PolicyDecision;

pub use decision::PolicyOutcome;

pub use delegation::Delegation;

Modules

decision

Policy decision types aligned with converge-core’s gate model.

delegation

Delegation tokens — scoped, time-limited authority grants.

engine

Cedar policy evaluation engine.

flow

Cedar implementation of the neutral flow gate contract from converge-core.

formation

Formation-facing discovery metadata for Arbiter capabilities.

primitives

provenance

Arbiter’s ProvenanceSource marker.

suggestor

types

Domain types for policy decisions.

Structs

FlowGateDecision

Full gate decision with rationale and source attribution.

FlowGateInput

Canonical input to an authorization decision for a flow gate.

Enums

FlowAction

Action being attempted against a converging flow.

FlowGateError

Pure error surface for flow gate authorization.

FlowGateOutcome

Neutral outcome of a flow gate authorization decision.

Constants

EXPENSE_APPROVAL_POLICY

Built-in Cedar policies for reference and testing.

EXPENSE_APPROVAL_SCHEMA

FLOW_GOVERNANCE_POLICY

VENDOR_SELECTION_POLICY

Traits

FlowGateAuthorizer

Deterministic decision provider for consequential flow actions.