Struct PolicyTable 

pub struct PolicyTable { /* private fields */ }

Per-action authorization policy with optional operator overrides.

Wraps the compile-time baseline (min_role_for_action) with a map of per-action overrides loaded from [policy.risk_overrides] in ~/.config/sysknife/config.toml.

Security invariant: overrides may only raise the minimum role. A downgrade attempt is rejected at construction time so a misconfigured — or maliciously modified — config can never silently grant escalated access.

Implementations

impl PolicyTable

pub fn empty() -> Self

Construct an empty policy table — no overrides, identical behaviour to the compile-time baseline.

pub fn from_overrides( raw: &HashMap<String, String>, ) -> Result<Self, PolicyValidationError>

Construct a policy table from a risk_overrides map.

Validates each entry:

• the action name must be known to min_role_for_action;
• the risk level must parse to Low/Medium/High;
• the resulting role must be at or above the compile-time baseline.

On any violation, returns the first error encountered (callers should surface it as a fatal startup error so operator typos are loud).

pub fn min_role_for_action(&self, action_name: &str) -> Option<CallerRole>

Effective minimum CallerRole for action_name, accounting for overrides. Returns None for unknown actions.

pub fn action_allowed(&self, caller: &CallerRole, action_name: &str) -> bool

Whether caller is authorized to invoke action_name under this table. Returns false for unknown actions.

pub fn active_overrides(&self) -> Vec<(&str, CallerRole)>

Active overrides, sorted by action name. Suitable for an INFO-level startup log.

pub fn override_count(&self) -> usize

Number of active overrides.

Trait Implementations

impl Clone for PolicyTable

fn clone(&self) -> PolicyTable

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyTable

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PolicyTable

fn default() -> PolicyTable

Returns the “default value” for a type.