Struct RuntimeScope 

pub struct RuntimeScope {
    pub caller_id: Option<String>,
    pub tenant_id: Option<String>,
    pub claims: BTreeMap<String, Value>,
}

Per-execution identity surface (Parslee-ai/car#187 phase 3).

Constructed by the dispatcher from caller-identity surfaces on the inbound ActionProposal; threaded through Runtime::execute_* so downstream layers (memgine, state, audit log) can route on caller_id / tenant_id. See the module docstring for what’s enforced in this PR vs. deferred.

Designed to be cheap to clone — small fixed fields plus a BTreeMap of arbitrary claims. The dispatcher typically builds one per inbound message, so allocations are bounded.

Default returns the unscoped (all-None) value. The runtime treats this as “no identity” — same legacy behaviour as the pre-#187 path. The non-scoped Runtime::execute_with_cancel entry point internally passes &RuntimeScope::default() so existing in-process callers see no behaviour change.

Fields

caller_id: Option<String>

Verified subject when the dispatcher’s AuthValidator returned an Identity, else the cooperative a2a_caller.caller_id hint, else None. Empty string (Some("")) is never produced — the dispatcher normalizes to None before building the scope.

tenant_id: Option<String>

Tenant scoping key. Either the verified-claim tenant id, the cooperative-peer hint from Message.metadata, or None. The downstream memgine / state filters key on this — distinct from caller_id because one tenant can have many callers (humans + their agents) and the isolation boundary is the tenant, not the individual caller.

claims: BTreeMap<String, Value>

Bag of verified token claims forwarded by the dispatcher. subject itself is already on caller_id; this carries the surrounding metadata (iss, aud, org_id, roles, etc.) in a structured form so audit logs don’t have to re-parse the inbound message.

Stored as a BTreeMap for stable iteration order in event logs and deterministic serialization. The dispatcher decides which claims to forward; this type makes no guarantees about which keys are present.

Implementations

impl RuntimeScope

pub fn new(caller_id: Option<String>, tenant_id: Option<String>) -> Self

Build a scope from caller_id + tenant_id only, with no extra claims. Used by tests and by callers that don’t yet surface a full claim set.

pub fn is_unscoped(&self) -> bool

True when the scope carries no identity at all — equivalent to the Default shape. The car-a2a dispatcher’s default-deny check uses this: if auth is on but the scope is unscoped, reject before dispatch.

Trait Implementations

impl Clone for RuntimeScope

fn clone(&self) -> RuntimeScope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuntimeScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RuntimeScope

fn default() -> RuntimeScope

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RuntimeScope

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RuntimeScope

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.