Enum DenyOrigin 

pub enum DenyOrigin {
    Gotcha,
    ConsultMandate,
    Policy,
}

Which gate produced a Decision::Deny.

Each origin already maps 1:1 to a distinct decision_reason_code in the enforcement log, so this is information the system requires downstream and used to drop between the decision and the message. Matching on it exhaustively means a new origin cannot silently inherit whatever branch its key prefix happens to land in.

Variants

Gotcha

Confirmed gotcha above the enforcement threshold. file_key is the record to consult.

ConsultMandate

Inherited signed-floor consult mandate. file_key is the mandated file.

Policy

Local policy. file_key is the POLICY key, which is not consultable — the consultable key lives in reason.

Implementations

impl DenyOrigin

pub fn deny_event(self, key: String) -> HookEvent

The event that records this deny in the enforcement log.

Origin and event are chosen together at every deny site, and each event maps to a distinct decision_reason_code downstream. Deriving the event here means the agent-facing message and the audit chain cannot disagree about what denied, and a new origin cannot be added without choosing one.

Trait Implementations

impl Clone for DenyOrigin

fn clone(&self) -> DenyOrigin

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DenyOrigin

impl Debug for DenyOrigin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for DenyOrigin

impl PartialEq for DenyOrigin

fn eq(&self, other: &DenyOrigin) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DenyOrigin