Skip to main content

granted_capabilities

polyc_capability

Function granted_capabilities 

Source 
pub const fn granted_capabilities(
    policy: GrantPolicy,
    taint: TaintState,
) -> CapabilitySet
Expand description

Derive the capabilities granted to one gate decision from the agent’s policy and the provenance state at that moment.

Recomputed per call, because taint can enter mid-turn and must revoke for the very next call.

The containment rule: taint present ⇒ TAINT_REVOKED (arbitrary egress AND external mutation) removed from the granted set; the operator-declared taint-resilient set survives the subtraction, but never grants beyond the base. Monotonic under a fixed policy: adding taint never adds a capability (pinned by test).