Module envelope 

Executable permission envelope for tools.

Structs

Envelope

Executable permission envelope declared by a tool.

FilesystemRule

Filesystem access rule.

NetworkRule

Single network allow-list rule.

SensitivePredicate

Predicate over validated input that marks an invocation as sensitive.

SubprocessRule

Subprocess execution rule.

Enums

DataClassification

Informational data classification.

FilesystemMode

Filesystem access mode.

NetworkPolicy

Network egress policy for a tool.

Safety

Total safety order for executable behavior.

SensitiveMatcher

Matcher for a sensitive invocation predicate.