Crate praxis_policy

Expand description

PPE is a policy enforcement runtime for AI agents.

It is a deterministic reference monitor between an agent and every capability it invokes: tools, prompts, resources, inference providers, and A2A methods. Each operation runs through a policy-defined pipeline that can resolve identity, make an authorization decision (delegated to an engine like Cedar or CEL), exchange and reduce credentials before a downstream call, redact inputs and outputs, track information flow across calls, and audit. You write that policy declaratively in APL, the configuration that defines each operation’s pipeline; PPE evaluates and enforces it at the boundary, against state the model cannot observe or forge.

Source and issues: https://github.com/praxis-proxy/policy

§This crate

praxis-policy is the host facade: one dependency that re-exports the PPE runtime (praxis-policy-core, praxis-policy-apl-core, praxis-policy-apl-cmf, praxis-policy-apl-runtime), so a host depends on this crate instead of pinning each of them separately.

By default it is the engine only: no builtin plugins are compiled in. The bundled plugins, PDPs and session stores are registered from here, each behind a feature, and only what you enable is compiled.

§Usage

Engine only (register your own factories):

use std::sync::Arc;
use praxis_policy::PolicyEngine;

let mgr = Arc::new(PolicyEngine::default());
// ... register host factories, then `praxis_policy_apl_runtime::register_apl(&mgr, opts)`.

With the bundled builtins (enable the builtins feature):

use std::sync::Arc;
use praxis_policy::PolicyEngine;

let mgr = Arc::new(PolicyEngine::default());
// Register every enabled builtin factory and install the APL config
// visitor (in-process defaults) in one call:
praxis_policy::install_builtins(&mgr);
// ... then load a config that references the enabled `kind`s.

§Features

No plugins are on by default (praxis-policy alone is the engine). builtins enables every bundled extension, including the Valkey session store; or pick a granular subset (jwt, api-key, oauth, elicitation-ciba, cedar, cel, opa, valkey, secrets-vault). Any of them brings in the registration helpers, and each one re-exports its own concrete factory type here.

§Plugins the host supplies

A plugin does not have to be bundled. Implement PluginFactory and hand it to PolicyEngine::register_factory under the kind: your YAML names; prelude is the surface to write it against. An unrecognised kind is a load-time error, so a missing registration fails at startup rather than silently skipping the plugin.

reference/plugins/ in this repository holds two worked examples, a PII scanner and an audit logger. Neither is published or bundled; a host registers them.

Re-exports§

pub use http_hyper::HyperTransport;
pub use praxis_policy_apl_cmf;
pub use praxis_policy_apl_core;
pub use praxis_policy_apl_runtime;
pub use praxis_policy_core;

Modules§

http_hyper: A default HttpTransport on hyper, for hosts that inject none.
prelude: Curated re-exports for plugin authors, so a plugin crate can depend on this facade alone. See praxis_policy_core::prelude. Curated re-exports for plugin authors. Curated surface for plugin authors.

Structs§

ApiKeyIdentityFactory: Factory for kind: identity/api-key plugins.
AplOptions: Configuration for register_apl. All runtime collaborators APL needs to do its work are funneled through here so the call site reads as a single block instead of a multi-step builder.
CedarDirectPdpFactory: Factory for CedarDirectResolver. Reports kind() = "cedar-direct"; builds resolvers from the unified-config block via CedarDirectResolver::from_config.
CelPdpFactory: Factory for CelResolver. Reports kind() = "cel"; builds resolvers from the unified-config block via CelResolver::from_config.
CibaApproverFactory: Factory for kind: elicitation/ciba plugins. Instantiates a CibaApprover from the config: block and registers it on the elicit hook.
DispatchCache: Host-owned dispatch cache. Construct once, share via Arc<DispatchCache> across all CmfPluginInvoker::for_request calls so plans built for one request can be reused by the next.
JwtIdentityFactory: Factory for kind: identity/jwt plugins. Instantiates a JwtIdentityResolver from the config: block and registers it on the identity.resolve hook.
MemorySessionStore: In-process SessionStore backed by a HashMap of HashSets. Suitable for tests, single-process deployments, and as the default when no distributed store is configured. Cloning the store via Arc shares state across all consumers.
OAuthDelegatorFactory: Factory for kind: delegator/oauth plugins. Instantiates an OAuthDelegator from the config: block and registers it on the token.delegate hook.
OpaPdpFactory: Factory for OpaResolver. Reports kind() = "opa"; builds resolvers from the unified-config block via OpaResolver::from_config.
PluginInstance: The two types a host needs to accept a plugin it did not compile in: PolicyEngine::register_factory takes a Box<dyn PluginFactory>, and PluginInstance is what that factory returns.
PolicyEngine: Owns registered plugins and dispatches hook invocations to them.
ProviderFailure: What a host needs to give the engine its secrets.
ProviderHealth: What a host needs to give the engine its secrets.
QuotaFactory: Factory for kind: quota/limitador. Builds one shared Quota core and registers the check on cmf.llm_input and the debit on cmf.llm_output.
RefreshReport: What a host needs to give the engine its secrets.
SecretProviderRegistry: What a host needs to give the engine its secrets.
SecretRef: What a host needs to give the engine its secrets.
SecretSnapshot: What a host needs to give the engine its secrets.
ValkeyConfig: Parsed global.session_store config for kind: valkey.
ValkeySessionStoreFactory: Factory the host registers via AplOptions.session_store_factories.
VaultDelegatorFactory: Factory that constructs a VaultDelegator from its plugin configuration.
VaultSecretProviderFactory: Builds a Vault KV v2 SecretProvider.

Enums§

SecretError: What a host needs to give the engine its secrets.
SecretsHealth: What a host needs to give the engine its secrets.

Constants§

API_KEY_KIND: The plugin kind: string operators write in PPE YAML.
CIBA_KIND: The plugin kind: string operators write in PPE YAML to declare a CIBA elicitation handler.
JWT_KIND: The plugin kind: string operators write in PPE YAML to declare a JWT identity resolver.
OAUTH_KIND: The plugin kind: string operators write in PPE YAML to declare an OAuth RFC 8693 token-exchange delegator.
QUOTA_KIND: The kind: string operators write in PPE YAML. Namespaced (quota/…) so a second quota backend can register its own kind alongside this Limitador one.
VALKEY_KIND: The kind: discriminator this factory builds. Part of the public surface — it is the string operators write in their config.
VAULT_DELEGATOR_KIND: The kind: value operators write in PPE YAML to select this plugin.
VAULT_SECRET_KIND: The kind: this factory registers as.

Traits§

PdpFactory: Build a PdpResolver from a unified-config block. Implemented per PDP backend (cedar-direct, opa, …) and registered with the praxis-policy-apl-runtime visitor so unified-config YAML can declare PDPs without the host pre-constructing them in code.
PluginFactory: The two types a host needs to accept a plugin it did not compile in: PolicyEngine::register_factory takes a Box<dyn PluginFactory>, and PluginInstance is what that factory returns.
SecretProvider: What a host needs to give the engine its secrets.
SecretProviderFactory: What a host needs to give the engine its secrets.
SessionStore: Pluggable session-state backend. Implementations must be Send + Sync — the same store is shared across all concurrent requests.
SessionStoreFactory: Factory the visitor consults when it encounters a global.session_store block in the unified config. Mirrors praxis_policy_apl_core::step::PdpFactory: each factory advertises a kind() string matching the YAML block’s kind: field, and build turns the block into a live store. Registered up front via crate::AplOptions::session_store_factories; the visitor selects the active store from config during its global-config walk, before any route handler captures the store.

Functions§

builtin_pdp_factories: The enabled PDP factories, ready to drop into AplOptions::pdp_factories. A route’s cedar:, cel: or opa: step selects which one runs.
builtin_session_store_factories: The enabled session-store factories, ready to drop into AplOptions::session_store_factories. A global.session_store: { kind: ... } config block selects one; absent that, the in-process MemorySessionStore default stays active.
install_builtins: Register every enabled plugin factory and install the APL config visitor on mgr with in-process defaults (a MemorySessionStore and the default baseline capabilities). The enabled PDP and session-store factories are wired in, so a later config load can reference any of them by kind.
install_builtins_with_default_http_transport: Register the enabled builtins and use hyper when the host has not already installed an HTTP transport.
install_default_http_transport: Install the bundled hyper transport so plugins can perform outbound HTTP.
register_apl: Build an AplConfigVisitor from the supplied options and register it on the engine. Returns the Arc<AplConfigVisitor> so the caller can stash it for later inspection (or call register_pdp on it after the fact for late-bound resolvers) — but in the typical case the return value is dropped and the visitor lives inside the engine’s visitor list.
register_builtin_plugins: Register every enabled by-kind plugin factory on mgr: identity (jwt), delegators (oauth), and elicitation approvers (elicitation-ciba). Call before loading a config so the engine can instantiate plugins whose YAML kind: matches.
register_vault_secret_provider: Register this backend on registry.
registry_with_vault: A registry with env, file, and vault.
warn_experimental_features: Warn that experimental extensions are compiled in. Gated on experimental, which every experimental-* feature sets; call at host startup.