Enum AuditEvent 

pub enum AuditEvent {
    ToolAccess {
        timestamp: DateTime<Utc>,
        agent: String,
        tool: String,
        allowed: bool,
        layer: Option<String>,
        reason: Option<String>,
    },
    PathAccess {
        timestamp: DateTime<Utc>,
        agent: String,
        path: String,
        mode: String,
        allowed: bool,
        layer: Option<String>,
        reason: Option<String>,
    },
    ExecAccess {
        timestamp: DateTime<Utc>,
        agent: String,
        binary: String,
        allowed: bool,
        layer: Option<String>,
        reason: Option<String>,
    },
    RbacDecision {
        timestamp: DateTime<Utc>,
        subject: String,
        action: String,
        resource: String,
        allowed: bool,
        reason: Option<String>,
    },
    SandboxViolation {
        timestamp: DateTime<Utc>,
        agent: String,
        path: String,
        workspace: String,
    },
    Approval {
        timestamp: DateTime<Utc>,
        approval_id: String,
        subject: String,
        action: String,
        status: String,
    },
}

Unified security audit event.

Every security-relevant decision produces one of these variants. Serialized as JSONL for file persistence and ingested into the Merkle-chain AuditTrail for tamper-evidence.

Variants

ToolAccess

Tool access decision.

Fields

timestamp: DateTime<Utc>

agent: String

tool: String

allowed: bool

layer: Option<String>

reason: Option<String>

PathAccess

Path access decision.

Fields

timestamp: DateTime<Utc>

agent: String

path: String

mode: String

allowed: bool

layer: Option<String>

reason: Option<String>

ExecAccess

Command execution decision.

Fields

timestamp: DateTime<Utc>

agent: String

binary: String

allowed: bool

layer: Option<String>

reason: Option<String>

RbacDecision

RBAC authorization decision.

Fields

timestamp: DateTime<Utc>

subject: String

action: String

resource: String

allowed: bool

reason: Option<String>

SandboxViolation

Workspace sandbox violation.

Fields

timestamp: DateTime<Utc>

agent: String

path: String

workspace: String

Approval

Human-in-the-loop approval event.

Fields

timestamp: DateTime<Utc>

approval_id: String

subject: String

action: String

status: String

Implementations

impl AuditEvent

pub fn actor(&self) -> &str

Returns the agent/subject responsible for this event.

pub fn to_audit_action(&self) -> AuditAction

Convert to an AuditAction for the Merkle-chain AuditTrail.

Trait Implementations

impl Clone for AuditEvent

fn clone(&self) -> AuditEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuditEvent

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuditEvent

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.