Enum Capability 

pub enum Capability {
    FileRead {
        path_pattern: String,
    },
    FileWrite {
        path_pattern: String,
    },
    FileEdit {
        path_pattern: String,
    },
    FileList {
        path_pattern: String,
    },
    FileFind {
        path_pattern: String,
    },
    Bash {
        allowed_commands: Vec<StringPattern>,
        timeout_secs: Option<u64>,
    },
    Network {
        allowed_domains: Vec<String>,
    },
    WebBrowse {
        allowed_domains: Vec<String>,
    },
    Subagent {
        max_children: Option<usize>,
    },
    BusRead {
        channel: Option<String>,
    },
    BusWrite {
        channel: Option<String>,
    },
    EnvRead {
        allowed_vars: Vec<String>,
    },
    ToolUse {
        tool_name: String,
    },
    McpAccess {
        resource_patterns: Vec<String>,
    },
}

A fine-grained permission that can be granted to an agent.

Each variant captures the specific resource and access level. The Authorizer checks these at tool execution time.

Variants

FileRead

Read files matching a glob pattern.

Fields

path_pattern: String

Glob pattern selecting the paths this capability permits reading (e.g. src/**/*.rs).

FileWrite

Write or create files matching a glob pattern.

Fields

path_pattern: String

Glob pattern selecting the paths this capability permits writing or creating.

FileEdit

Edit existing files matching a glob pattern.

Fields

path_pattern: String

Glob pattern selecting the paths this capability permits editing.

FileList

List directory entries matching a glob pattern.

Fields

path_pattern: String

Glob pattern selecting the paths this capability permits listing.

FileFind

Find files matching a glob pattern.

Fields

path_pattern: String

Glob pattern selecting the paths this capability permits finding.

Bash

Execute a restricted set of shell commands.

Fields

allowed_commands: Vec<StringPattern>

Command names or StringPattern matchers the agent is permitted to invoke.

timeout_secs: Option<u64>

Maximum wall-clock seconds a single command may run before being killed.

Network

Make outbound network requests to a set of domains.

Fields

allowed_domains: Vec<String>

Domains the agent is permitted to contact (e.g. api.example.com).

WebBrowse

Browse web pages on a set of domains.

Fields

allowed_domains: Vec<String>

Domains the agent is permitted to browse.

Subagent

Spawn child agents as subagents.

Fields

max_children: Option<usize>

Maximum number of concurrent children this grant permits (None = unbounded).

BusRead

Read from an inter-agent message bus channel.

Fields

channel: Option<String>

Channel name the grant covers (None = all channels).

BusWrite

Write to an inter-agent message bus channel.

Fields

channel: Option<String>

Channel name the grant covers (None = all channels).

EnvRead

Read environment variables.

Fields

allowed_vars: Vec<String>

Names of environment variables the agent is permitted to read.

ToolUse

Invoke a named tool.

Fields

tool_name: String

Name of the tool this capability permits calling.

McpAccess

Access MCP server resources.

Fields

resource_patterns: Vec<String>

Patterns matching the MCP resource URIs the agent may access.

Implementations

impl Capability

pub fn satisfies(&self, required: &Capability) -> bool

Whether this capability satisfies (is at least as permissive as) required.

Trait Implementations

impl Clone for Capability

fn clone(&self) -> Capability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Capability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Capability

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Capability

impl Hash for Capability

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for Capability

fn eq(&self, other: &Capability) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Capability

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Capability