Struct AccessGate 

pub struct AccessGate { /* private fields */ }

Single entry point for all authorization decisions.

Every tool execution, path access, command execution, network request, and agent fork must pass through this gate.

Example

use oxios_kernel::access_manager::{AccessGate, CheckRequest, PathMode};

// AccessGate is constructed during kernel initialization with internal
// parking_lot::Mutex<AccessManager>, ExecConfig, and an AuditSink.
// Security checks use AgentContext (provided by the kernel's agent lifecycle).
//
// gate.check(CheckRequest::Tool { context: &ctx, tool_name: "exec" })?;
// gate.check(CheckRequest::Path {
//     context: &ctx,
//     path: Path::new("/workspace/file.rs"),
//     mode: PathMode::Read,
// })?;

Implementations

impl AccessGate

pub fn new( access: Arc<Mutex<AccessManager>>, exec_config: Arc<ExecConfig>, audit: Arc<dyn AuditSink>, ) -> Self

Create a new access gate.

pub fn access_clone(&self) -> Arc<Mutex<AccessManager>>

Clone the inner access manager Arc (for ExecTool fallback).

pub fn check(&self, req: CheckRequest<'_>) -> Result<(), AccessDenied>

Perform a synchronous authorization check.

All decisions (allow and deny) are recorded to the audit sink. Checks are evaluated in order with short-circuit: the first layer to deny stops further evaluation.

Trait Implementations

impl Debug for AccessGate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.