Crate tirea_extension_permission 

Permission policy extension.

External callers use PermissionAction, permission_state_action, PermissionPlugin, and ToolPolicyPlugin.

Re-exports

pub use parser::parse_pattern;

pub use pattern::ArgMatcher;

pub use pattern::FieldCondition;

pub use pattern::MatchOp;

pub use pattern::PathSegment;

pub use pattern::ToolCallPattern;

pub use pattern::ToolMatcher;

Modules

matcher

Pattern matching engine for ToolCallPattern.

parser

Parse permission rule pattern strings into ToolCallPattern.

pattern

Function-call-style permission rule patterns.

Structs

PermissionEvaluation

Strategy evaluation output.

PermissionMechanismInput

Runtime input required to enforce permission decisions for one tool call.

PermissionOverrideGranter

Concrete tirea_contract::runtime::tool_call::ToolAccessGranter that creates run-scoped permission overrides. Injected into skill tools via DI.

PermissionOverrides

Run-scoped permission overrides applied on top of thread-level PermissionPolicy.

PermissionPlugin

Permission strategy plugin.

PermissionPolicy

Persisted permission rules.

PermissionRule

Declarative permission rule.

PermissionRulesConfig

Permission rules carried in AgentRunConfig.extensions.

PermissionRuleset

Resolved rule set fed into permission strategy evaluation.

ToolPolicyPlugin

Tool scope policy plugin.

Enums

PermissionAction

Permission-domain action used by both PermissionPolicy and PermissionOverrides reducers. Scope and source metadata are determined by the target reducer, not by fields on the action itself.

PermissionDestination

Target state for a permission rule change.

PermissionMechanismDecision

Mechanism output after combining strategy verdict with runtime state.

PermissionRuleScope

Lifetime of a remembered permission rule.

PermissionRuleSource

Origin of a remembered permission rule.

PermissionSubject

Permission rule subject.

ToolPermissionBehavior

Tool permission behavior.

Constants

PERMISSION_CONFIRM_TOOL_NAME

Frontend tool name for permission confirmation prompts.

PERMISSION_PLUGIN_ID

Stable plugin id for permission actions.

Functions

apply_tool_policy

Apply tool policy: keep only allowed tools, remove excluded ones.

deny

Block tool execution with a denial reason.

deny_missing_call_id

Block tool execution when permission check prerequisites fail (missing call id).

deny_tool

Block tool execution for an explicitly denied tool.

enforce_permission

Apply runtime permission mechanism to a strategy verdict.

evaluate_tool_permission

Evaluate permission rules for a tool call with arguments.

permission_confirmation_ticket

Build the default tool-like permission confirmation form.

permission_confirmation_ticket_with_rule

Build a permission confirmation form, optionally including the matched rule pattern.

permission_override_action

Route a PermissionAction to the run-scoped PermissionOverrides state.

permission_rules_from_snapshot

Load resolved permission rules from a runtime snapshot.

permission_state_action

Route a PermissionAction to the canonical PermissionPolicy state.

permission_update

Unified dispatch: routes a PermissionAction to the specified destination.

reject_out_of_scope

Block tool execution due to policy (out-of-scope).

remembered_permission_state_action

Translate a remembered permission decision into a persistent rule mutation.

request_permission

Suspend tool execution pending user permission confirmation.

resolve_permission_behavior

Resolve effective permission behavior from a state snapshot.