Module policy 

Authorization policy for the daemon.

Combines two checks:

1. Per-action allowlist — each known action name maps to a minimum CallerRole. This is a compile-time constant so the daemon never executes an action whose policy was not reviewed at build time.

Approval freshness and one-time receipt consumption live in the transaction store so verification and the queued-to-running transition are atomic.

Operators may raise the minimum role for individual actions via the [policy.risk_overrides] config section. See PolicyTable.

Structs

PolicyTable

Per-action authorization policy with optional operator overrides.

Enums

PolicyValidationError

Errors that can occur while validating [policy.risk_overrides] at startup.

Functions

action_allowed

Check whether caller is authorized to invoke action_name against the compile-time baseline (no operator overrides).

min_role_for_action

Minimum CallerRole required to call action_name, or None if the action is unknown (no ActionSpec).

role_for_risk_level

Map a RiskLevel to the CallerRole it requires under the baseline.