Struct PolicyConfig 

pub struct PolicyConfig {
    pub enforcement: bool,
    pub approver_sets: HashMap<String, Vec<String>>,
    pub require_payload_schema: bool,
    pub require_consent: Vec<RequireConsentRule>,
}

Policy Decision Point configuration.

Fields

enforcement: bool

When true, every dispatched Trust Task is evaluated by the PDP before its handler runs, and a non-allow decision rejects the task. Default false — enforcement is opt-in so a deployment turns it on deliberately, after authoring policies. The boot-installed baseline allows current flows, so enabling this changes nothing until an operator adds a restrictive, higher-priority policy (expand-before-contract).

approver_sets: HashMap<String, Vec<String>>

Named approver sets a policy’s requireConsent references by name; each maps to the DIDs permitted to approve a task’s execution. Empty by default — a requireConsent naming an unknown or empty set can never be satisfied (fail-closed), so operators define sets before using them.

require_payload_schema: bool

Refuse any task for which this build knows no payload schema.

Payload validation always runs where a schema is known — that is not optional and has no switch. This governs the other case: 62 of the tasks this VTA dispatches have no published spec yet, and refusing them outright would break them.

So the default is to validate what we can, warn about what we cannot, and proceed. An operator who would rather fail closed sets this — and should understand what they are choosing: “no schema” currently means “no spec has been written”, not “this task is suspicious”.

Default false. It is a stopgap, and the honest fix is to write the missing specs.

require_consent: Vec<RequireConsentRule>

Consent requirements declared in config, reconciled into the PDP at every boot.

This is the operator-facing way to require human approval for a task without editing and recompiling the baseline Rego. The reference implementation has no runtime policy-install surface; before this, turning on consent meant editing policies/default.rego, rebuilding, and booting against an empty policy keyspace. That is a source change to express an operational choice.

Each rule here becomes a synthesized requireConsent policy, installed under a reserved id above the permissive baseline, and reconciled on every boot — so config is the source of truth: add a rule and restart to require consent, remove it and restart to stop. Anything the declarative form cannot express is still authored as a full Rego policy; this covers the common case, which is “a human must approve this task”.

Trait Implementations

impl Clone for PolicyConfig

fn clone(&self) -> PolicyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PolicyConfig

fn default() -> PolicyConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PolicyConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PolicyConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.