Struct PrivilegeReview 

pub struct PrivilegeReview { /* private fields */ }

What a definition actually grants, measured against the requirement.

05-infrastructure.md item 2 and 07-security.md’s release gate (“Service account permissions are documented and verified least privilege”) are the same requirement stated twice, and this is the verification half. The documentation half is docs/service-account.md.

The review reads the rendered text, not the plan it came from. That is deliberate and it is the only version of this check worth having: a review that re-derived its expectations from the same values the renderer used would agree with the renderer by construction and could never fail. Reading the text means a hand-edited unit on a real host is reviewed as it is, and means a test can widen a definition and watch this say so.

Implementations

impl PrivilegeReview

pub fn is_least_privilege(&self) -> bool

Whether the definition grants nothing beyond the requirement.

pub fn findings(&self) -> &[PrivilegeFinding]

Everything the review found, excesses and shortfalls together.

pub fn excesses(&self) -> Vec<&PrivilegeFinding>

Only the excesses — the findings that make Self::is_least_privilege false.

pub fn controls(&self) -> &[String]

The controls the definition was confirmed to carry.

Present so that a passing review says what it checked rather than only that it passed. A check that reports nothing when it succeeds is indistinguishable from a check that did not run.

pub const fn account(&self) -> &ServiceAccount

The account the registration runs under, and why it is the minimum.

pub const fn kind(&self) -> DefinitionKind

Which platform’s definition was reviewed.

Trait Implementations

impl Clone for PrivilegeReview

fn clone(&self) -> PrivilegeReview

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PrivilegeReview

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PrivilegeReview

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PrivilegeReview

impl PartialEq for PrivilegeReview

fn eq(&self, other: &PrivilegeReview) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PrivilegeReview