Struct PolicyEngine 

pub struct PolicyEngine { /* private fields */ }

Thread-safe Cedar policy engine.

Wraps the Cedar Authorizer + PolicySet + Schema + entity store. All state is behind an RwLock so policies and entities can be updated at runtime without restart.

Implementations

impl PolicyEngine

pub fn new( schema_text: &str, policies: &[(&str, &str)], ) -> Result<PolicyEngine, PolicyError>

Create a new policy engine from schema and policy files.

Validates the schema and all policies at construction time. Returns an error if any schema or policy is invalid.

pub fn open_mode() -> PolicyEngine

Create a policy engine in open mode: all requests are allowed.

Used when the cedar feature is disabled or for development/testing.

Warning

Open mode is unsafe for production. Every authorization request is permitted without any policy evaluation. A tracing::error! is emitted at construction time so that production monitoring surfaces the misconfiguration. Configure policies_dir to enable Cedar evaluation.

pub fn load_from_brain(brain_dir: &Path) -> Result<PolicyEngine, PolicyError>

Load policies from a brain directory.

Reads {brain_dir}/policies/hirn.cedarschema (or uses default schema) and all *.cedar files in {brain_dir}/policies/.

Fails closed when no policy files are present. Use Self::load_from_brain_insecure_dev_mode to explicitly opt into the built-in permit-all development policy.

pub fn load_from_brain_insecure_dev_mode( brain_dir: &Path, ) -> Result<PolicyEngine, PolicyError>

Load policies from a brain directory, permitting the built-in default open policy when no *.cedar files are present.

This is intended only for explicit development/test posture. A tracing::error! is emitted to surface this misconfiguration.

pub fn is_open_mode(&self) -> bool

Check whether this engine is in open mode (all requests allowed).

pub fn is_enabled(&self) -> bool

Whether Cedar policy evaluation is active (not open mode).

pub fn policy_count(&self) -> usize

Returns the number of loaded policies.

pub fn entity_count(&self) -> usize

Returns the number of registered entities.

pub fn registered_namespaces(&self) -> Vec<(String, String)>

List all registered namespace IDs and their associated realms.

pub fn list_policies(&self) -> Vec<(String, String)>

List all policy source names and their raw Cedar text.

pub fn authorize(&self, request: &AuthzRequest) -> AuthzDecision

Authorize a request against loaded policies.

Returns an AuthzDecision indicating whether the request is allowed or denied, along with diagnostic information.

pub fn allowed_namespaces_for( &self, agent_id: &str, action: Action, ) -> Option<Vec<String>>

Resolve which namespaces an agent can access for a given action.

Returns None if engine is in open mode (permit all). Returns Some(vec![...]) with allowed namespace IDs otherwise.

pub fn register_agent( &self, agent_id: &str, reputation: i64, created_at: &str, teams: &[&str], ) -> Result<(), PolicyError>

Register an agent entity.

pub fn register_team( &self, team_id: &str, description: &str, organization: Option<&str>, ) -> Result<(), PolicyError>

Register a team entity.

pub fn register_organization( &self, org_id: &str, description: &str, ) -> Result<(), PolicyError>

Register an organization entity.

pub fn register_realm( &self, realm_id: &str, description: &str, ) -> Result<(), PolicyError>

Register a realm entity.

pub fn register_namespace( &self, namespace_id: &str, classification: &str, realm: &str, ) -> Result<(), PolicyError>

Register a namespace entity.

pub fn register_memory_layer( &self, layer_id: &str, description: &str, ) -> Result<(), PolicyError>

Register a memory layer entity (Working, Episodic, Semantic, Procedural).

pub fn register_operation( &self, operation_id: &str, description: &str, ) -> Result<(), PolicyError>

Register an operation entity (Recall, Think, Remember, etc.).

pub fn register_tool( &self, tool_id: &str, description: &str, ) -> Result<(), PolicyError>

Register a tool entity for MCP tool-level access control.

pub fn remove_entity(&self, key: &str) -> Result<bool, PolicyError>

Remove an entity by its Cedar key (e.g. Hirn::Agent::"agent-007").

pub fn add_policy( &self, name: &str, policy_text: &str, ) -> Result<(), PolicyError>

Add or replace a policy source.

pub fn add_policies(&self, policies: &[(&str, &str)]) -> Result<(), PolicyError>

Atomically add or replace multiple policy sources.

pub fn remove_policy(&self, name: &str) -> Result<bool, PolicyError>

Remove a policy source by name.

pub fn validate(&self) -> Vec<String>

Validate the current schema against all loaded policies.

pub fn save_to_brain(&self, brain_dir: &Path) -> Result<(), PolicyError>

Save the current policies and schema to a brain directory.

Trait Implementations

impl Clone for PolicyEngine

fn clone(&self) -> PolicyEngine

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyEngine

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.