Trait PolicyEngine 

pub trait PolicyEngine: Send + Sync {
    // Required methods
    fn evaluate_session_start<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        identity: &'life1 AuthIdentity,
        mode: &'life2 str,
        env: &'life3 Envelope,
    ) -> Pin<Box<dyn Future<Output = PolicyDecision> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait;
    fn evaluate_message<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        identity: &'life1 AuthIdentity,
        session: &'life2 Session,
        env: &'life3 Envelope,
    ) -> Pin<Box<dyn Future<Output = PolicyDecision> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait;
    fn evaluate_session_access<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        identity: &'life1 AuthIdentity,
        session: &'life2 Session,
    ) -> Pin<Box<dyn Future<Output = PolicyDecision> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait;
}

Decision points an external engine may govern at ingress.

Required Methods

fn evaluate_session_start<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, identity: &'life1 AuthIdentity, mode: &'life2 str, env: &'life3 Envelope, ) -> Pin<Box<dyn Future<Output = PolicyDecision> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

May identity start a session in mode? Runs after authentication and the security layer’s own checks, before the kernel accepts the SessionStart.

fn evaluate_message<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, identity: &'life1 AuthIdentity, session: &'life2 Session, env: &'life3 Envelope, ) -> Pin<Box<dyn Future<Output = PolicyDecision> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

May identity send this session-scoped envelope? Runs after mode binding is known, before kernel acceptance.

fn evaluate_session_access<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, identity: &'life1 AuthIdentity, session: &'life2 Session, ) -> Pin<Box<dyn Future<Output = PolicyDecision> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

May identity observe this session (GetSession / StreamSession subscribe)? Purely a read gate; never replayed.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors