Struct PolicyConfig 

pub struct PolicyConfig {
    pub enforcement: bool,
    pub approver_sets: HashMap<String, Vec<String>>,
    pub approvals: Vec<ApprovalRule>,
    pub require_payload_schema: bool,
    pub require_consent: (),
}

Policy Decision Point configuration.

Fields

enforcement: bool

When true, every dispatched Trust Task is evaluated by the PDP before its handler runs, and a non-allow decision rejects the task. Default false — enforcement is opt-in so a deployment turns it on deliberately, after authoring policies. The boot-installed baseline allows current flows, so enabling this changes nothing until an operator adds a restrictive, higher-priority policy (expand-before-contract).

approver_sets: HashMap<String, Vec<String>>

Named approver sets a policy’s requireConsent references by name; each maps to the DIDs permitted to approve a task’s execution. Empty by default — a requireConsent naming an unknown or empty set can never be satisfied (fail-closed), so operators define sets before using them.

Seed, not source of truth. Approver sets now live on the declarative approvals row in the policy keyspace, editable at runtime with pnm approvals approvers. What is here is copied into that row the first time the VTA boots without one, so an IaC-provisioned or freshly-restored VTA comes up already configured. After that the row wins and this is inert: re-reading it every boot would silently undo runtime edits on the next restart, which is the trap the old reconcile-every-boot consent policy had.

approvals: Vec<ApprovalRule>

Declarative approval rules — which tasks require re-authentication or consent before they run.

Same seed-once semantics as PolicyConfig::approver_sets: this is the bring-up path for a VTA with no declarative row yet, not a second place the rules live. Read them back (and change them) with pnm approvals.

require_payload_schema: bool

Refuse any task for which this build knows no payload schema.

Payload validation always runs where a schema is known — that is not optional and has no switch. This governs the other case: 62 of the tasks this VTA dispatches have no published spec yet, and refusing them outright would break them.

So the default is to validate what we can, warn about what we cannot, and proceed. An operator who would rather fail closed sets this — and should understand what they are choosing: “no schema” currently means “no spec has been written”, not “this task is suspicious”.

Default false. It is a stopgap, and the honest fix is to write the missing specs.

require_consent: ()

Retired: [[policy.require_consent]].

Present only to refuse a config that still declares it. It was the third way to tell a VTA an operation needs a human — alongside the [auth.step_up] floors and Self::approvals — and it behaved differently from both: reconciled from the file on every boot, so it silently reverted anything an operator changed at runtime.

Self::approvals replaces it and is seeded once, then owned by pnm approvals — which is the difference that matters. A rule you can change at runtime and read back is a rule you can diagnose.

Absent (the only accepted state) deserializes to () via default.

Trait Implementations

impl Clone for PolicyConfig

fn clone(&self) -> PolicyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PolicyConfig

fn default() -> PolicyConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PolicyConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PolicyConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.