Struct Rule 

pub struct Rule {
    pub act: Act,
    pub effect: Effect,
    pub pattern: String,
}

One rule: an effect applied to an action whose target matches pattern.

pattern is a glob (* any run including /, ? one character) matched against the target’s full relative path or its basename, the same way the find tool matches. That is what lets .env deny config/.env.

The basename half is why a bare filename is a recursive deny, and it is the reason to construct a Rule deliberately rather than reaching for the nearest-looking builder:

use io_harness::{Act, Effect, Policy, Rule};

// `*` spans `/`, so this is not "one directory down".
let deny_anywhere = Rule { act: Act::Read, effect: Effect::Deny, pattern: ".env".into() };
let deny_one_tree = Rule { act: Act::Read, effect: Effect::Deny, pattern: "vendor/*".into() };

let policy = Policy::permissive()
    .layer("secrets")
    .rule(deny_anywhere.act, deny_anywhere.effect, deny_anywhere.pattern.clone())
    .rule(deny_one_tree.act, deny_one_tree.effect, deny_one_tree.pattern.clone());

// Matched on the basename: every `.env` at every depth.
assert_eq!(policy.check(Act::Read, "deploy/staging/.env").effect, Effect::Deny);
// Matched on the full relative path, and `*` crosses directories.
assert_eq!(policy.check(Act::Read, "vendor/lib/src/main.rs").effect, Effect::Deny);
// Neither form matches, so the tier default decides.
assert_eq!(policy.check(Act::Read, "src/main.rs").effect, Effect::Allow);

A Rule is also what an approver hands back in Decision::Approve::remember, and what a deserialized operator config is made of — it is Serialize/Deserialize for exactly that.

Fields

act: Act

Which kind of action this rule governs.

effect: Effect

What to do when it matches.

pattern: String

The glob matched against the path (or binary name, for Act::Exec).

Trait Implementations

impl Clone for Rule

fn clone(&self) -> Rule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Rule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Rule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Rule

impl PartialEq for Rule

fn eq(&self, other: &Rule) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Rule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Rule