Struct KeyPolicy 

pub struct KeyPolicy {
    pub label: String,
    pub max_age: Option<Duration>,
    pub audit_every_use: bool,
}

What a key is allowed to authorise.

Exists from the first release with a single variant in practical use, because a keyring without policy is just more keys that can do everything — strictly worse than one key. Adding the concept later would mean auditing every existing key’s authority retroactively.

Fields

label: String

Human-facing note for logs and audit (“backend”, “break-glass”).

max_age: Option<Duration>

Reject a signature older than this. None = no freshness bound.

None is required for the ordinary signer, not merely convenient. The agent’s JetStream replay path deliberately redelivers the most recent retained command per subject, kept for 7 days, so an agent reconnecting after a week legitimately receives week-old commands. A bound on the backend key would reject exactly that.

A break-glass key sets a short bound, and there the bound is doing real work rather than being belt-and-braces. Replay dedup is keyed on request_id in an in-memory cache, which is empty on first boot — so without a freshness check, a machine booting for the first time would execute a week-old emergency command that no dedup can catch.

audit_every_use: bool

Emit an audit record on every use of this key, including failed verifications.

A break-glass credential whose use nobody investigates is a second production key with extra steps, so the flag lives next to the key rather than in a call site that can forget it.

Implementations

impl KeyPolicy

pub fn backend(label: impl Into<String>) -> Self

The ordinary signer: no extra freshness bound, no per-use audit (the command itself is already audited).

pub fn break_glass(label: impl Into<String>, max_age: Duration) -> Self

A deliberately-guarded key: short-lived signatures, every use recorded.

Trait Implementations

impl Clone for KeyPolicy

fn clone(&self) -> KeyPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for KeyPolicy

impl PartialEq for KeyPolicy

fn eq(&self, other: &KeyPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for KeyPolicy