Struct RuleGroup 

pub struct RuleGroup {
    pub id: String,
    pub reason: Option<String>,
    pub shell: Vec<String>,
    pub fs_read: Vec<String>,
    pub fs_write: Vec<String>,
    pub net: Vec<String>,
    pub fetch: Vec<String>,
    pub env_read: Vec<String>,
    pub env_set: Vec<String>,
    pub mcp: Vec<String>,
    pub hook_only: bool,
}

One named group of patterns. A group matches when any of its patterns matches the atomic action of the corresponding kind.

Fields

id: String

Stable identifier shown in decisions and the audit log.

reason: Option<String>

Text prepended to the reason when this group decides.

shell: Vec<String>

Shell patterns (token prefixes, *, !, trailing $).

fs_read: Vec<String>

Path globs for file reads.

fs_write: Vec<String>

Path globs for file writes.

net: Vec<String>

Host globs for any network access, fetches included.

fetch: Vec<String>

Host globs for read-only fetches by a host’s fetch tool only.

env_read: Vec<String>

Variable-name globs for reads.

env_set: Vec<String>

Variable-name globs for sets.

mcp: Vec<String>

MCP tool-name globs.

hook_only: bool

Applied by the hook only (ADR-034): OS layers leave this group’s fs.read and fs.write paths to the other rules, so a build tool a sandboxed command runs can still read them. deny groups only, never with net or fetch.

Implementations

impl RuleGroup

pub fn patterns(&self, kind: Kind) -> &[String]

The patterns this group lists for kind.

pub fn check_patterns(&self) -> Result<(), PolicyError>

Check that every pattern of this group parses, naming the group in the error: what Policy::lint does for each group.

Errors

PolicyError::Rule for the first pattern that does not parse.

Trait Implementations

impl Clone for RuleGroup

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleGroup

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RuleGroup

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RuleGroup

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for RuleGroup

impl PartialEq for RuleGroup

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RuleGroup

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RuleGroup