Struct Policy 

pub struct Policy {

    pub version: u32,
    pub defaults: Defaults,
    pub scope: Option<Scope>,
    pub deny: Vec<RuleGroup>,
    pub allow: Vec<RuleGroup>,
    pub review: Vec<RuleGroup>,
    pub defer: Vec<RuleGroup>,
    pub approval: Option<Approval>,
    pub executables: BTreeMap<String, Vec<String>>,
    pub sandbox: Option<SandboxSettings>,
    pub secrets: Vec<Secret>,
    pub taint: Option<TaintSettings>,
    pub staging: Option<StagingSettings>,
    pub require_signed_repo_policy: bool,
    pub mcp: Option<McpSettings>,
    pub check_diff: Option<Settings>,
    pub require: Option<Require>,
    pub require_added: Vec<(RequiredBy, Require)>,
    pub repo_review: Vec<RuleGroup>,
    pub old_names: OldNames,
}

The policy document (policy.yaml), as written by users.

Fields

version: u32

Schema version; only 1 is supported.

defaults: Defaults

Verdict when no rule matches.

scope: Option<Scope>

Reserved for multi-root projects; parsed so existing files stay valid, not yet consulted (policy lint warns).

deny: Vec<RuleGroup>

Evaluated first; a match is final.

allow: Vec<RuleGroup>

Evaluated after deny.

review: Vec<RuleGroup>

Evaluated after allow: calls a person reviews. Read from ask: too, its name before ADR-053 (OldNames).

defer: Vec<RuleGroup>

Evaluated after review: calls the agent’s own permission flow decides (ADR-025). Absent in policies written before it existed.

approval: Option<Approval>

Reserved for the kernel’s own approval prompt; parsed so existing files stay valid, not yet consulted (policy lint warns).

executables: BTreeMap<String, Vec<String>>

Basename → allowed absolute paths (defeats PATH poisoning).

sandbox: Option<SandboxSettings>

What the operating-system layers OpenMoat configures need beyond the rules (ADR-018). Absent in policies written before it existed.

secrets: Vec<Secret>

Secrets moat proxy keeps from the agent and injects for one host each.

taint: Option<TaintSettings>

What session taint protects beyond the built-in list. Absent in older policies.

staging: Option<StagingSettings>

When a session counts as having collected files outside the project (ADR-061, proposed): the @staging-egress atom’s thresholds. Absent in older policies, which means the defaults.

require_signed_repo_policy: bool

Trust a repository policy only when its detached signature (policy.yaml.sig) verifies against a key the person trusted (ADR-031): a signed one needs no moat trust, and an unsigned one is not trusted even after moat trust. Off by default: then only moat trust lets a repository policy allow.

mcp: Option<McpSettings>

How moat mcp proxy treats tool definitions (ADR-032). Absent in older policies.

check_diff: Option<Settings>

The levels openmoat policy check-diff reports its content checks at (ADR-055). Absent in older policies: each check’s own level.

require: Option<Require>

The least protection level each agent must be at for openmoat guard to decide its calls; below it, every call is denied (protection-required, ADR-064). Absent in older policies and the default: nothing is required.

require_added: Vec<(RequiredBy, Require)>

The require: sections of the repository policy and the packs merged in (Policy::add_requirement), read with Self::require by Policy::required_for, which takes the strictest: they raise a level, never lower one. Never read from or written to a file.

repo_review: Vec<RuleGroup>

Review rules merged in from a repository policy (crate::RepoPolicy, ADR-022) or a policy pack (ADR-031). Tried after deny and before allow, so a repository can make an action the user allows need review. Never read from or written to a file, and not lowered to OS layers, which are generated from the user policy alone.

old_names: OldNames

Where the file used ask, the old name of review (ADR-053), which policy lint warns about. Set by Policy::parse; never written.

Implementations

impl Policy

pub fn required_for(&self, host: Option<&str>) -> Option<Requirement>

The level host (a host id; None for a program that is no known agent) must be at: the strictest that the policy and every repository policy and pack merged into it ask for, or None when none does.

pub fn add_requirement(&mut self, by: RequiredBy, require: &Require)

Add the requirement require of by (a repository policy or a pack) to the ones Self::required_for reads. It can only raise a level.

impl Policy

pub fn own_group(&self, id: &str) -> Option<&RuleGroup>

The group of the person’s own lists (deny, allow, review, defer, policy packs included) with id id. Never a repository policy’s review rule (Policy::repo_review): its words are not the person’s, and the message they would head reaches the agent.

pub fn untitled(&self) -> Vec<&str>

The ids of the deny and review groups without a title, in policy order: their message falls back to the rule id and reason.

impl Policy

pub fn package_min_release_age_days(&self) -> u16

The days a package version must have been published before moat run lets npm and uv install it; 0 is off.

pub fn trust_mcp_first_sight(&self) -> bool

Whether moat mcp proxy pins a new server’s tools without a person accepting them (mcp.trust_first_sight, ADR-032).

pub fn browser_open_is_fetch(&self) -> bool

Whether an MCP call that only opens a web page is decided as a fetch (mcp.browser_open, ADR-047): yes unless the policy says net.

pub fn mcp_flow_trusted(&self) -> &[String]

The MCP servers whose data flows need no mcp-cross-server review (mcp.flow_trusted, ADR-058).

impl Policy

pub fn parse(yaml: &str) -> Result<Self, PolicyError>

Parse and lint a policy document. Pure: takes the YAML text.

pub fn lint(&self) -> Result<(), PolicyError>

Structural validation independent of any environment: Self::lint_structure and every pattern’s syntax (RuleGroup::check_patterns).

pub fn lint_structure(&self) -> Result<(), PolicyError>

Self::lint without parsing each pattern again, for a policy that gained rule groups after a full lint, such as a merge of rules each checked when they were read (a repository policy, a pack, openmoat allow rules): the new groups’ patterns are checked with RuleGroup::check_patterns, and nothing else needs reparsing. Parsing every pattern costs more than the rest of the lint together, and crate::CompiledPolicy::compile reports a bad one in any case.

pub fn rule_count(&self) -> (usize, usize, usize)

Number of rule groups in deny, allow and review.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Policy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Policy

impl PartialEq for Policy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Policy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Policy