pub fn preset(name: &str) -> Option<CapabilitySet>Expand description
Resolve a role preset name to its capability set (spec §6).
Presets are a non-contract convenience mapping — they may change freely
and are not part of the frozen wire contract. Returns None for an unknown
name so the caller can surface a clear error.
The gradient’s cut line is exec. A token holding exec reaches every
file this process can, so withholding the file API from it confines nothing
and only forces callers onto the slow path. The presets below therefore
split into “carries exec, and so carries everything” and “carries no exec,
and so the file capabilities are a real boundary”.