Struct VerifiedResponse 

pub struct VerifiedResponse {

    pub turn_id: String,
    pub request_id: String,
    pub tool_name: String,
    pub args_json: String,
    pub modified_args_json: String,
    pub approved: bool,
    pub approved_for_session: bool,
    pub covered_capabilities: Vec<String>,
    pub caller: String,
    pub approver: String,
    pub sandbox_mode: String,
    pub reason: String,
    pub injected_context: String,
    pub conversation_id: String,
    pub nonce: String,
    pub signer_public_key: Vec<u8>,
}

A decoded approval_response payload after signature verification.

Fields

turn_id: String

Turn that emitted this occurrence. Empty only on durable responses written before occurrence identity was introduced.

request_id: String

The tool-call id this response answers.

tool_name: String

The bound tool name — the approval applies only to this exact call.

args_json: String

The bound args_json — the model’s PROPOSED args, the identity the approval is bound to. Self::authorizes_call matches this byte-for-byte, so a re-emitted call with different args cannot inherit the approval. This is the args the approver saw, NOT necessarily the args that execute.

modified_args_json: String

The approver’s EDIT to the proposed args — the args to actually execute, or empty when the approver did not edit (execute args_json unchanged). Signed, so the edit is unforgeable and auditable; the delta from args_json is the recorded mutation. Resolve the effective execution args with the pure polyc_agent::resolve_approved_call.

approved: bool

Whether the request was approved.

approved_for_session: bool

Whether the approval is remembered for the rest of the session (“don’t ask again”); false for a one-shot approval.

covered_capabilities: Vec<String>

The capability shortfall this approval covered (#595): the stable kebab-case capability names the gate reported missing when it paused the call. Covered by the signature, so the effective session-grant key is (caller, tool, covered capabilities) — a grant recorded against one covered set never satisfies the same tool after its required set grows. Empty for an approval of an ordinary policy/sandbox gate.

caller: String

The caller identity the (session) approval is scoped to — the paused turn’s own beneficiary (RFC 8693 sub/subject), NOT necessarily who clicked. Set by the trusted control plane and covered by the signature, so a session grant cannot be re-scoped to a different user.

approver: String

The identity that actually resolved this decision (#1025, RFC 8693 act/actor), when the edge supplied one — empty otherwise (no edge integration yet, or a payload signed before this field existed). Distinct from caller: an admin approving on someone else’s behalf signs a different approver than caller. For approval-policy checks and the audit trail ONLY — never fed into principal_ref (see caller’s own resume-attribution use in the control plane).

sandbox_mode: String

The sandbox/permission mode the paused turn ran under, covered by the signature so a grant cannot be replayed under a different mode.

reason: String

Free-form human-supplied reason.

injected_context: String

Context the approver attached to inject before the tool runs — prepended as an internal_only message ahead of execution, or empty when none. Signed, so an injected instruction is unforgeable and recorded.

conversation_id: String

The conversation the approval was granted in, covered by the signature so a token signed for one conversation cannot be replayed into another (#370, closes #77 bug 3B).

nonce: String

Per-approval unique value, covered by the signature. A consumer records it on use so the token cannot be re-presented once spent (single-use, #370).

signer_public_key: Vec<u8>

The verified signer’s public key (encoded).

Implementations

impl VerifiedResponse

pub fn authorizes_call( &self, request_id: &str, tool_name: &str, args_json: &str, ) -> bool

Whether this verified, approved token authorizes the EXACT call (request_id, tool_name, args_json) — the args-binding (#370 item 3).

The signed args_json is matched byte-for-byte, so a re-emitted same-id call with different arguments (or a different tool) is NOT authorized: a captured approval can never be reused to run a different action. A denial (approved == false) authorizes nothing.

Trait Implementations

impl Clone for VerifiedResponse

fn clone(&self) -> VerifiedResponse

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifiedResponse

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.