Struct ForwardDerivation 

pub struct ForwardDerivation {
    pub keep_verified_user: bool,
    pub keep_roles: bool,
    pub keep_capabilities: bool,
    pub keep_metadata: bool,
}

What a policy returns: a derivation request, NOT a constructed context.

The framework consumes this and mints the next sealed AuthContext for the callee. The shape is intentionally minimal for v1 — four “keep” flags, one per logical group of the caller’s context. Future composable primitives (AUTHLANG v2) will replace this with a richer combinator AST without breaking the v1 trait signature.

Derive-only invariant

Every field is a “keep” flag: forward this field from the caller to the callee, or drop it. There is no “add this role” or “set this user_id” knob. Policies cannot escalate authority across a boundary — the most-permissive a callee context can be is exactly the caller’s context.

Field-to-AuthContext mapping (today)

Flag	Maps to fields on the current AuthContext
keep_verified_user	user_id, session_id (identity of the originator)
keep_roles	roles
keep_capabilities	(no field yet; reserved for AUTHZ-DATA / AUTHZ-CRED work)
keep_metadata	metadata

keep_capabilities is intentionally surfaced now so the v1 shape is forward-compatible: when the sealed-context migration adds a capabilities field, no policy impl signature changes.

Fields

keep_verified_user: bool

Forward the IdP-verified originator’s identity (user_id, session_id).

keep_roles: bool

Forward the caller’s role set (roles).

keep_capabilities: bool

Forward the caller’s capability set. Reserved for the AUTHZ-DATA / AUTHZ-CRED migration; today this flag is a no-op on AuthContext because the field does not yet exist.

keep_metadata: bool

Forward the caller’s opaque metadata bag (metadata).

Implementations

impl ForwardDerivation

pub const IDENTITY_ONLY: Self

Identity-only: keep verified user; drop roles, capabilities, metadata.

pub const PASS_THROUGH: Self

Pass-through: keep every flag.

pub const ANONYMOUS: Self

Anonymous: keep no flag.

Trait Implementations

impl Clone for ForwardDerivation

fn clone(&self) -> ForwardDerivation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ForwardDerivation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ForwardDerivation

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ForwardDerivation

fn eq(&self, other: &ForwardDerivation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ForwardDerivation

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for ForwardDerivation

impl Eq for ForwardDerivation

impl StructuralPartialEq for ForwardDerivation