Struct CListPolicy 

pub struct CListPolicy { /* private fields */ }

CList (Capability List) policy backend.

Each object has a capability space listing the targets it can access and the operations it can perform. Data classifications map targets to exposure labels. Exposure rules define which targets are blocked when specific exposure labels are present.

Implementations

impl CListPolicy

pub fn from_config(config: PolicyConfig) -> CListPolicy

Create a CList policy from a parsed configuration.

pub fn from_toml(content: &str) -> Result<CListPolicy, PolicyConfigError>

Create a CList policy from a TOML string.

pub fn from_file(path: &Path) -> Result<CListPolicy, PolicyConfigError>

Create a CList policy from a TOML file.

pub fn empty() -> CListPolicy

Create an empty policy (useful for testing).

Trait Implementations

impl PolicyBackend for CListPolicy

fn evaluate( &self, subject: &ObjectId, target: &ObjectId, operation: &Operation, exposure_labels: &[ExposureLabel], ) -> PolicyDecision

Evaluate whether a subject can access a target with the given operation, considering any exposure labels from the subject’s context.

fn classification(&self, target: &ObjectId) -> Vec<ExposureLabel>

Get the data classification (exposure labels) for a target.

fn list_grants(&self, subject: &ObjectId) -> Vec<CapabilityGrant>

List all capability grants for a subject (for introspection and audit).

fn can_delegate(&self, subject: &ObjectId) -> bool

Check if a subject can delegate capabilities to other objects.