Struct Policy 

pub struct Policy {

    pub path: Option<String>,
    pub fail_mode: FailMode,
    pub allow_bypass_env: bool,
    pub allow_bypass_env_noninteractive: bool,
    pub paranoia: u8,
    pub severity_overrides: HashMap<String, Severity>,
    pub additional_known_domains: Vec<String>,
    pub allowlist: Vec<String>,
    pub blocklist: Vec<String>,
    pub approval_rules: Vec<ApprovalRule>,
    pub network_deny: Vec<String>,
    pub network_allow: Vec<String>,
    pub webhooks: Vec<WebhookConfig>,
    pub checkpoints: CheckpointPolicyConfig,
    pub scan: ScanPolicyConfig,
    pub allowlist_rules: Vec<AllowlistRule>,
    pub custom_rules: Vec<CustomRule>,
    pub dlp_custom_patterns: Vec<String>,
    pub policy_server_url: Option<String>,
    pub policy_server_api_key: Option<String>,
    pub policy_fetch_fail_mode: Option<String>,
    pub enforce_fail_mode: Option<bool>,
}

Policy configuration loaded from YAML.

Fields

path: Option<String>

Path this policy was loaded from.

fail_mode: FailMode

Fail mode: “open” (default) or “closed”.

allow_bypass_env: bool

Allow TIRITH=0 bypass in interactive mode.

allow_bypass_env_noninteractive: bool

Allow TIRITH=0 bypass in non-interactive mode.

paranoia: u8

Paranoia tier (1-4).

severity_overrides: HashMap<String, Severity>

Severity overrides per rule.

additional_known_domains: Vec<String>

Additional known domains (extends built-in list).

allowlist: Vec<String>

Allowlist: URL patterns that are always allowed.

blocklist: Vec<String>

Blocklist: URL patterns that are always blocked.

approval_rules: Vec<ApprovalRule>

Approval rules: commands matching these rules require human approval.

network_deny: Vec<String>

Network deny list: block commands targeting these hosts/CIDRs.

network_allow: Vec<String>

Network allow list: exempt these hosts/CIDRs from network deny.

webhooks: Vec<WebhookConfig>

Webhook endpoints to notify on findings.

checkpoints: CheckpointPolicyConfig

Checkpoint configuration (Pro+).

scan: ScanPolicyConfig

Scan configuration overrides.

allowlist_rules: Vec<AllowlistRule>

Per-rule allowlist scoping (Team).

custom_rules: Vec<CustomRule>

Custom detection rules defined in YAML (Team).

dlp_custom_patterns: Vec<String>

Custom DLP redaction patterns (Team). Regex patterns applied alongside built-in patterns when redacting commands in audit logs and webhooks.

policy_server_url: Option<String>

URL of the centralized policy server (e.g., “https://policy.example.com”).

policy_server_api_key: Option<String>

API key for authenticating with the policy server.

policy_fetch_fail_mode: Option<String>

Fail mode for remote policy fetch: “open” (default), “closed”, or “cached”.

enforce_fail_mode: Option<bool>

Whether to enforce the fetch fail mode strictly (ignore local fallback on auth errors).

Implementations

impl Policy

pub fn discover_partial(cwd: Option<&str>) -> Self

Discover and load partial policy (just bypass + fail_mode fields). Used in Tier 2 for fast bypass resolution.

pub fn discover(cwd: Option<&str>) -> Self

Discover and load full policy.

Resolution order:

1. Local policy (TIRITH_POLICY_ROOT, walk-up discovery, user-level)
2. Team+ only: if TIRITH_SERVER_URL + TIRITH_API_KEY are set (or policy has policy_server_url), try remote fetch. On success the remote policy replaces the local one entirely and is cached.
3. On remote failure, apply policy_fetch_fail_mode:
   • "open" (default): warn and use local policy
   • "closed": return a fail-closed default (all actions = Block)
   • "cached": try cached remote policy, else fall back to local
4. Auth errors (401/403) always fail closed regardless of mode.

pub fn severity_override(&self, rule_id: &RuleId) -> Option<Severity>

Get severity override for a rule.

pub fn is_blocklisted(&self, url: &str) -> bool

Check if a URL is in the blocklist.

pub fn is_allowlisted(&self, url: &str) -> bool

Check if a URL is in the allowlist.

pub fn load_user_lists(&mut self)

Load and merge user-level lists (allowlist/blocklist flat text files).

pub fn load_org_lists(&mut self, cwd: Option<&str>)

Load and merge org-level lists from a repo root’s .tirith/ dir.

Note: Org-level policies are committed to the repository and may be controlled by other contributors. A diagnostic is emitted so the user knows that repo-level policy is active.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Policy

where Policy: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Policy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.