Skip to main content

decide

polyc_capability

Function decide 

Source 
pub fn decide(
    required: CapabilitySet,
    granted: CapabilitySet,
    policy: &CallPolicy,
    tool_name: &str,
) -> GateOutcome
Expand description

The one pure decision: compare what the call requires with what it is granted, under the argument-aware policy verdicts, and return the single GateOutcome.

Precedence, pinned by test:

  1. hard policy veto ⇒ GateOutcome::Deny;
  2. required ⊄ granted ⇒ GateOutcome::Escalate carrying the missing set and a plain-language reason;
  3. the policy demands a human (argument-aware gate or sandbox-denial escalation) ⇒ GateOutcome::Escalate with an empty missing set;
  4. otherwise honor the argument transform or allow.

The engine is pure set algebra over the capability sets — it never matches on a specific Capability, so extending the taxonomy requires no change here (pinned by test).