Struct Defaults 

pub struct Defaults {
    pub read: Effect,
    pub write: Effect,
    pub exec: Effect,
    pub net: Effect,
}

The default effect for an action no rule mentions.

This is the part of a policy that decides what happens to everything you did not think of, so it is the part worth setting on purpose. Deny-by-default makes the rule list exhaustive — anything unnamed is refused — which is the shape an unattended run wants:

use io_harness::{Act, Defaults, Effect, Policy};

let mut policy = Policy::permissive().layer("job").allow_read("src/*").allow_write("out/*");
policy.defaults = Defaults {
    read: Effect::Deny,
    write: Effect::Deny,
    exec: Effect::Deny,
    net: Effect::Deny,
};

// Named: allowed. Unnamed: refused, without ever asking a human.
assert_eq!(policy.check(Act::Read, "src/lib.rs").effect, Effect::Allow);
assert_eq!(policy.check(Act::Read, "/etc/passwd").effect, Effect::Deny);

Two defaults it is easy to be surprised by. Policy::default() sets write and exec to Effect::Ask, so a run with no approver behind it stalls on its first write unless a rule allows it outright. And net defaults to Effect::Deny everywhere, including for a policy deserialized from a 0.7.0 config that has no net field — the harness contributes the configured provider’s host as its own layer, so the model is still reachable and nothing else is.

Fields

read: Effect

Default for reads. Reads inside the allow list are the permissive tier.

write: Effect

Default for writes. Every write asks, including an in-policy overwrite.

exec: Effect

Default for spawning a binary.

net: Effect

Default for opening an outbound connection.

#[serde(default)] is load-bearing: a policy serialized by 0.7.0 or earlier has no net field at all, and it deserializes here to Deny. That is a deliberate behaviour change — an old config that made outbound calls stops making them until it carries a net allow — chosen because the alternative silently leaves egress ungoverned for exactly the callers who upgraded to govern it.

Trait Implementations

impl Clone for Defaults

fn clone(&self) -> Defaults

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Defaults

impl Debug for Defaults

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Defaults

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Defaults

impl PartialEq for Defaults

fn eq(&self, other: &Defaults) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Defaults

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Defaults