oxicode_sdk/security/
mod.rs

1//! Capability-based security module.
2//!
3//! Provides fine-grained, deny-by-default permissions for agents:
4//! - **Capability**: individual permission (FileRead, Bash, etc.)
5//! - **CapabilitySet**: named preset bundles (coding, read_only, etc.)
6//! - **Authorizer**: grant/check/revoke with role hierarchy
7//! - **SecurityMiddleware**: tool execution guard via Middleware trait
8
9mod audit_sink;
10mod authorizer;
11pub mod capability;
12mod context;
13mod exec_policy;
14mod gate;
15pub mod middleware;
16mod permissions;
17mod rbac;
18
19pub use audit_sink::{AuditEvent, AuditSink, TracingAuditSink, TrailAuditSink};
20pub use authorizer::{Authorizer, DefaultPolicy};
21pub use capability::{Capability, CapabilitySet, CapabilitySubject, StringPattern};
22pub use context::AgentContext;
23pub use exec_policy::{AllowlistMode, ExecPolicy};
24pub use gate::{AccessDenied, AccessGate, CheckRequest, DenyLayer, PathMode};
25pub use middleware::SecurityMiddleware;
26pub use permissions::{AgentPermissions, PermAuditEntry, PermissionUpdate};
27pub use rbac::{
28    Action, ApprovalStatus, PendingApproval, RbacAuditEntry, RbacManager, RbacPolicy, Role, Subject,
29};
oxicode_sdk/security/mod.rs

oxicode_sdk/security/
mod.rs
