Struct ExecMediationPolicy 

pub struct ExecMediationPolicy {
    pub enabled: bool,
    pub deny_threshold: ExecRiskTier,
    pub deny_patterns: Vec<String>,
    pub allow_patterns: Vec<String>,
    pub audit_all_classified: bool,
}

Policy configuration for exec mediation (SEC-4.3).

Controls which commands are allowed/denied based on pattern matching and dangerous command classification. Evaluated after capability-level policy and quota checks but before the actual command is spawned.

Fields

enabled: bool

When true, exec mediation is active and commands are classified.

deny_threshold: ExecRiskTier

Minimum risk tier that triggers a deny (default: Critical). Commands at or above this tier are blocked.

deny_patterns: Vec<String>

Explicit command prefixes to deny (case-insensitive substring match). These are checked before the built-in classifier.

allow_patterns: Vec<String>

Explicit command prefixes to allow even if classified as dangerous. Use sparingly — allows overriding the classifier for specific tools.

audit_all_classified: bool

When true, commands classified as dangerous are logged even if allowed.

Implementations

impl ExecMediationPolicy

pub const fn strict() -> Self

Strict preset: blocks High and above.

pub const fn permissive() -> Self

Permissive preset: only blocks Critical.

pub const fn disabled() -> Self

Disabled preset: no exec mediation.

Trait Implementations

impl Clone for ExecMediationPolicy

fn clone(&self) -> ExecMediationPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExecMediationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ExecMediationPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ExecMediationPolicy

where ExecMediationPolicy: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ExecMediationPolicy

fn eq(&self, other: &ExecMediationPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ExecMediationPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ExecMediationPolicy

impl StructuralPartialEq for ExecMediationPolicy