Enum SecurityTier 

pub enum SecurityTier {
    None,
    Hosted,
    Tier1,
    Tier2,
    Tier3,
}

Security tiers for sandboxing.

Tier1 → Tier3 form a monotonically increasing host-isolation ladder (Docker → gVisor → Firecracker). Hosted is not a peer on that ladder — it represents execution on third-party infrastructure (e.g. E2B) where the operator does not run their own sandbox host. It carries no on-host isolation guarantees but is not outright None, so it sits between None and Tier1 for ordering purposes.

Use tier >= SecurityTier::Tier1 when policies require host isolation.

Variants

None

No isolation — native execution (⚠️ DEVELOPMENT ONLY)

Hosted

Hosted cloud execution (e.g. E2B) — code runs on third-party infrastructure. No on-host isolation guarantees; trust assumption is “you trust the hosting provider.”

Tier1

Docker-based isolation

Tier2

gVisor-based isolation

Tier3

Firecracker-based isolation

Implementations

impl SecurityTier

pub fn from_dsl_sandbox(tier: &SandboxTier) -> Self

Map a DSL sandbox_tier value to the runtime’s SecurityTier.

dsl::SandboxTier::E2B maps to Hosted — it is not a host- isolation tier. The runner factory still picks the actual E2B backend; this mapping only affects how the agent’s security requirements are categorised in policy decisions.

Trait Implementations

impl Clone for SecurityTier

fn clone(&self) -> SecurityTier

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityTier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityTier

fn default() -> SecurityTier

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityTier

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for SecurityTier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Ord for SecurityTier

fn cmp(&self, other: &SecurityTier) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for SecurityTier

fn eq(&self, other: &SecurityTier) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for SecurityTier

fn partial_cmp(&self, other: &SecurityTier) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for SecurityTier

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for SecurityTier

impl StructuralPartialEq for SecurityTier