Struct ResourcePolicy 

pub struct ResourcePolicy {
    pub allow: Vec<String>,
    pub deny: Vec<String>,
    pub significant: Vec<String>,
}

Allow/deny policy for the scoped MCP gateway, evaluated over a run’s derived resources. deny wins: a run is rejected if any resource matches a deny pattern. If allow is non-empty, every resource must additionally match some allow pattern. Empty allow + empty deny is allow-all.

significant is the policy dimension: when set, the allow check is evaluated only over the derived resources whose group names match a significant pattern, and the ambient co-membership umbrella groups (ue, ue_content, windows, a clusters parent…) are filtered out before the check — so they never have to be enumerated in allow. This makes allow=cluster_1node_* over significant=cluster_* a true default-deny: a target that resolves to no significant resource cannot be proven in scope and is rejected. deny is unaffected — it still spans every derived resource, which is the conservative direction. Empty significant preserves the legacy behavior (allow is checked over every derived resource).

It mirrors the lease’s LeaseFilter (which names the groups that carry a lease); here the patterns name the groups that are significant for policy. The two dimensions are configured independently.

Fields

allow: Vec<String>

deny: Vec<String>

significant: Vec<String>

Implementations

impl ResourcePolicy

pub fn new(allow: Vec<String>, deny: Vec<String>) -> Self

pub fn with_significant(self, significant: Vec<String>) -> Self

Set the policy-significant group patterns (the policy dimension).

pub fn evaluate(&self, resources: &[String]) -> Result<(), String>

Ok(()) if the resource set is permitted, Err(reason) otherwise.

Trait Implementations

impl Clone for ResourcePolicy

fn clone(&self) -> ResourcePolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ResourcePolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ResourcePolicy

fn default() -> ResourcePolicy

Returns the “default value” for a type.