Enum PolicyAction 

pub enum PolicyAction {
    Read,
    Export,
    Change,
    SchemaApply,
    BranchCreate,
    BranchDelete,
    BranchMerge,
    Admin,
    GraphList,
    InvokeQuery,
}

Variants

Read

Export

Change

SchemaApply

BranchCreate

BranchDelete

BranchMerge

Admin

Reserved for policy-management surfaces. Per MR-724 Option A, this gates operator actions like hot-reloading policy / tokens (MR-726), querying the audit log (MR-732), and listing / approving pending two-person-rule requests (MR-734). None of those endpoints exist yet, so today no engine or HTTP code calls enforce(Admin, ...). The variant is kept in the enum so the action vocabulary is complete from chassis day one — when the first consumer surface ships, it can just call enforce(Admin, ResourceScope::Graph, actor) without needing to add the enum variant + update policy.yaml schemas + redeploy.

Operators can write Cedar rules referencing admin today; they won’t fire (no call site) but they’re load-bearing for the future shape. Avoid writing such rules until the first consumer endpoint ships to prevent confusion.

GraphList

MR-668: management action that operates on the server’s graph registry, not on a single graph’s contents. The Cedar appliesTo declaration binds it to resource: Server instead of the per-graph resource: Graph. Operators authorize a group with:

rules:
  - id: admins-can-list-graphs
    allow:
      actors: { group: admins }
      actions: [graph_list]

branch_scope and target_branch_scope are NOT supported for this action — there’s no branch context at the server level. Runtime graph_create / graph_delete are intentionally omitted from v0.6.0; operators add and remove graphs by editing omnigraph.yaml and restarting.

InvokeQuery

Gates invoking a server-side stored query by name. Per-graph and graph-scoped (no branch dimension, like Admin): the per-branch access of the query body is enforced by the inner Read/Change gate, so branch-scoping this outer gate would be redundant (and was wrong for snapshot reads). A rule that sets branch_scope on invoke_query is rejected by validate(). In this release it is coarse: an invoke_query allow rule permits any stored query on the graph (no per-query dimension yet); a future, additive refinement adds an optional query-name scope.

This gate sits at the HTTP boundary. The engine _as writers still enforce Read/Change per the query body, so a stored mutation is double-gated: invoke_query to reach the tool, plus change for the write itself.

Implementations

impl PolicyAction

pub fn as_str(self) -> &'static str

pub fn resource_kind(self) -> PolicyResourceKind

Which Cedar resource entity governs this action. Per-graph actions (Read, Change, …) apply to Omnigraph::Graph::"<id>". Server-scoped management actions (GraphList) apply to Omnigraph::Server::"root". Admin is reserved without a current call site; classified as per-graph until MR-724 picks a shape.

Trait Implementations

impl Clone for PolicyAction

fn clone(&self) -> PolicyAction

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PolicyAction

impl Debug for PolicyAction

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PolicyAction

fn deserialize<__D>( __deserializer: __D, ) -> Result<PolicyAction, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for PolicyAction

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for PolicyAction

impl FromStr for PolicyAction

type Err = Report

The associated error which can be returned from parsing.

fn from_str(value: &str) -> Result<PolicyAction, Report>

Parses a string s to return a value of this type.

impl Hash for PolicyAction

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for PolicyAction

fn eq(&self, other: &PolicyAction) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for PolicyAction

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PolicyAction

impl ValueEnum for PolicyAction

fn value_variants<'a>() -> &'a [PolicyAction]

All possible argument values, in display order.

fn to_possible_value<'a>(&self) -> Option<PossibleValue>

The canonical argument value.

fn from_str(input: &str, ignore_case: bool) -> Result<Self, String>

Parse an argument into Self.