Struct Policy 

pub struct Policy {
    pub agent_allow_tags: Vec<String>,
}

Agent access policy: machine-enforceable guardrails that travel with the vault. This is NOT access control — every recipient can read every shared secret by design, and an insider can use age directly or an old murk binary. Its value is constraining what the murk binary will expose to agents (CI, AI coding agents), enforced at the agent entry points (agent exec, agent grant). Lives in the plaintext header and is MAC-covered so it can’t be silently weakened.

Fields

agent_allow_tags: Vec<String>

Agent allow-list: in agent mode, a secret may be injected or granted only if it carries at least one of these tags. Default-deny once a policy is set — an untagged or wrong-tagged key is refused with a clear error. An empty list means no key is agent-injectable (agents fully locked out).

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Policy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Policy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Policy

impl PartialEq for Policy

fn eq(&self, other: &Policy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Policy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Policy