Struct SandboxDecisionDataAccessDenied 

pub struct SandboxDecisionDataAccessDenied {
    pub attestation: SandboxAttestation,
    pub command: Option<String>,
    pub confidence: Option<SandboxDenialConfidence>,
    pub control: SandboxControl,
    pub denial_class: SandboxDenialClass,
    pub denied_resource: Option<String>,
    pub enforcement_point: SandboxEnforcementPoint,
    pub kind: SandboxDecisionDataAccessDeniedKind,
    pub outcome: SandboxOutcome,
    pub platform: SandboxPlatform,
    pub process_name: Option<String>,
    pub tool_call_id: Option<String>,
}

An enforcement check refused a specific access. Emitted per refusal with no deduplication, including when policy permits the caller to bypass the denial. Carries no backend: the built-in checks that produce this run in-process against the effective policy.

Fields

attestation: SandboxAttestation

Runtime observation backing the denial.

command: Option<String>

Command whose execution the denial arose from. Populated only when content capture is enabled.

confidence: Option<SandboxDenialConfidence>

How strong the evidence behind this denial is. Lets an analysis separate denials the sandbox recorded from ones inferred from output text, which otherwise look identical.

control: SandboxControl

Sandbox control the denial belongs to. Follows from denialClass.

denial_class: SandboxDenialClass

Bounded class of the refused access.

denied_resource: Option<String>

Resource the check refused, when identified and content capture is enabled.

enforcement_point: SandboxEnforcementPoint

Runtime subsystem that performed the check

kind: SandboxDecisionDataAccessDeniedKind

Sandbox decision variant discriminator.

outcome: SandboxOutcome

Always denied.

platform: SandboxPlatform

Host operating-system family

process_name: Option<String>

Executable image associated with the captured denial, normalized to a basename. Populated only when content capture is enabled.

tool_call_id: Option<String>

Tool call the denial belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension.

Trait Implementations

impl Clone for SandboxDecisionDataAccessDenied

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxDecisionDataAccessDenied

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxDecisionDataAccessDenied

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxDecisionDataAccessDenied

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SandboxDecisionDataAccessDenied

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.