Struct SecurityPolicy 

pub struct SecurityPolicy {

    pub mode: SecurityMode,
    pub spotlight_external: bool,
    pub neutralize_special_tokens: bool,
    pub destyle_untrusted: bool,
    pub trifecta_gate: bool,
    pub pin_mcp_schemas: bool,
    pub authenticate_directives: bool,
    pub taint_file_provenance: bool,
    pub precise_exfil_gate: bool,
    pub gate_secret_reads: bool,
    pub detect_injection: bool,
    pub guard_threshold_percent: u8,
    pub guard_model: String,
    pub trusted_mcp_servers: Vec<String>,
}

Resolved, runtime-readable security policy. Derived from SecurityConfig; the default is spotlight-on.

Fields

mode: SecurityMode

spotlight_external: bool

Frame untrusted external output in spotlight delimiters.

neutralize_special_tokens: bool

Neutralize reserved chat-template special tokens inside untrusted spans so they cannot hijack turn segmentation (ChatBug / ChatInject / MetaBreak).

destyle_untrusted: bool

Destyle forged turn/reasoning markers (role-label prefixes, <think> tags) inside untrusted spans so they cannot read as a real turn or thought.

trifecta_gate: bool

Apply the lethal-trifecta gate (force approval when tainted context reaches an exfiltration-capable / destructive tool).

pin_mcp_schemas: bool

Pin + hash MCP tool schemas and require re-approval on change.

authenticate_directives: bool

Authenticate cross-agent / orchestration directives on the read path: a directive-looking span (Orchestrator directive: …) that lacks a valid process-scoped provenance stamp is tagged TrustLevel::Untrusted and quarantined, so a forged directive embedded in an untrusted subagent result cannot be obeyed as authoritative. Default OFF (net-new enforcement); byte-identical behaviour when disabled.

taint_file_provenance: bool

Track untrusted-origin file provenance: a file written while untrusted content is in context (or by a fetch/clone/MCP step) is recorded, and a later read of it is classified untrusted so it flows into the same taint / trifecta gate. First-party file reads stay trusted. Default OFF (net-new enforcement); byte-identical behaviour when disabled.

precise_exfil_gate: bool

Narrow the exfil axis of the lethal-trifecta gate to the real attack signature: fire only when the sink’s destination is attacker-originated (an endpoint seen in untrusted content) or the payload ships a secret, instead of on any exfil-capable tool while any untrusted content is in context. Cuts false confirmations on benign research/synthesis to a user-named destination. Default OFF (the coarse gate is byte-identical); when on it only ever narrows what gates (fail-safe on unknown sinks).

gate_secret_reads: bool

Also gate first-party secret/credential reads while tainted.

detect_injection: bool

Score untrusted content with an injection classifier (Layer 2) and let a flagged score tighten the trifecta gate. Implied by local-ml mode.

guard_threshold_percent: u8

Flag threshold as a percent in [0, 100] (see SecurityConfig).

guard_model: String

Neural-classifier selector resolved by the host’s lazy loader seam (see set_injection_classifier_loader). Empty keeps the heuristic.

trusted_mcp_servers: Vec<String>

MCP servers the operator has explicitly trusted (skip taint + pin).

Implementations

impl SecurityPolicy

pub fn from_config(config: &SecurityConfig) -> Self

pub fn is_off(&self) -> bool

pub fn server_is_trusted(&self, server: &str) -> bool

Trait Implementations

impl Clone for SecurityPolicy

fn clone(&self) -> SecurityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityPolicy

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SecurityPolicy

impl PartialEq for SecurityPolicy

fn eq(&self, other: &SecurityPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for SecurityPolicy