Struct CapabilityPolicy 

pub struct CapabilityPolicy {
    pub tools: Vec<String>,
    pub capabilities: BTreeMap<String, Vec<String>>,
    pub workspace_roots: Vec<String>,
    pub read_only_roots: Vec<String>,
    pub side_effect_level: Option<String>,
    pub recursion_limit: Option<usize>,
    pub tool_arg_constraints: Vec<ToolArgConstraint>,
    pub tool_annotations: BTreeMap<String, ToolAnnotations>,
    pub sandbox_profile: SandboxProfile,
    pub process_sandbox: ProcessSandboxPolicy,
}

Fields

tools: Vec<String>

capabilities: BTreeMap<String, Vec<String>>

workspace_roots: Vec<String>

read_only_roots: Vec<String>

Roots the workload may read but never write. A path resolving under one of these passes read scope checks yet is rejected for write_text/delete, and the generated OS sandbox profile grants it read-only. Intended to be disjoint from workspace_roots (which are read-write); cloud mounts lower their FilesystemAccess::ReadOnly entries here so a “read-only” mount is actually unwritable inside the sandbox.

side_effect_level: Option<String>

recursion_limit: Option<usize>

Remaining Harn-side nested-execution depth. The enter_nested_execution_policy helper validates this at every agent_loop, sub_agent_run, spawn_agent worker, workflow stage, and nested-workflow surface: Some(0) rejects the launch with a categorized BudgetExceeded error; Some(n>0) allows the descent and gives the child Some(n - 1). None disables the budget gate entirely.

tool_arg_constraints: Vec<ToolArgConstraint>

Argument-level constraints for specific tools.

tool_annotations: BTreeMap<String, ToolAnnotations>

Per-tool annotations (kind, arg schema, capabilities, side-effect level). Pipelines own the registry; the VM reads it.

sandbox_profile: SandboxProfile

Confinement strength applied to subprocesses spawned under this policy. Defaults to SandboxProfile::Worktree; pipelines opt into SandboxProfile::OsHardened when the workload should refuse to run if the platform sandbox is unavailable.

process_sandbox: ProcessSandboxPolicy

Process-only filesystem allowances layered into OS subprocess sandboxes without widening Harn file builtins.

Implementations

impl CapabilityPolicy

pub fn neutral() -> Self

The identity element under CapabilityPolicy::intersect: a policy that expresses no opinion on any axis.

Use this — not Default::default — to build an overlay: a policy that constrains some axes (tools, capabilities, side-effect level) and deliberately says nothing about the rest. Default is the confinement decision for a run that has none of its own, so it carries SandboxProfile::Worktree. An overlay built on Default inherits that profile and asserts filesystem confinement its author never intended. Merged into a parent the mistake is invisible, because intersect keeps the strictest profile and the parent’s is already at least as strict; with no parent the overlay is pushed verbatim and a deliberately unsandboxed run silently becomes sandboxed.

Unrestricted is the identity for the profile axis specifically: strictest_sandbox_profile ranks it lowest, so intersecting an overlay against any real parent yields the parent’s profile unchanged.

pub fn is_unbounded(&self) -> bool

pub fn tools_are_restricted(&self) -> bool

pub fn tools_deny_all(&self) -> bool

pub fn allowed_tool_patterns(&self) -> impl Iterator<Item = &str>

pub fn restrict_tools(&mut self, tools: Vec<String>)

pub fn tool_pattern_allows(&self, tool: &str) -> bool

pub fn capabilities_are_restricted(&self) -> bool

pub fn capabilities_deny_all(&self) -> bool

pub fn allowed_capabilities(&self) -> impl Iterator<Item = (&str, &[String])>

pub fn capability_operations(&self, capability: &str) -> Option<&[String]>

pub fn restrict_capabilities( &mut self, capabilities: BTreeMap<String, Vec<String>>, )

pub fn intersect( &self, requested: &CapabilityPolicy, ) -> Result<CapabilityPolicy, String>

pub fn assert_within_ceiling( &self, requested: &CapabilityPolicy, ) -> Result<(), String>

Enforce the ceiling invariant on a requested policy: every capability / budget / permission dimension must stay within (or narrower than) self, the workflow-level grant. Used where a Harn-computed flattened stage policy re-enters Rust: the flattener may narrow a ceiling but must never widen one. Returns a categorized error naming the widened dimension.

“Empty means unbounded” matches intersect: an empty tools / workspace_roots / read_only_roots / capabilities ceiling imposes no bound on that dimension, so anything passes.

Trait Implementations

impl Clone for CapabilityPolicy

fn clone(&self) -> CapabilityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CapabilityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CapabilityPolicy

fn default() -> CapabilityPolicy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CapabilityPolicy

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CapabilityPolicy

impl PartialEq for CapabilityPolicy

fn eq(&self, other: &CapabilityPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CapabilityPolicy

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CapabilityPolicy