Enum Capability 

pub enum Capability {
    VaultRead,
    VaultWrite,
    ProxyLogin,
    FillRelease,
    PolicyAdmin,
    DeviceAdmin,
    Sign,
    KeyMint,
    SignTrustTask,
    CredentialWrite,
}

Fine-grained capability flags scoped to the ACL entry’s allowed contexts. Used by route handlers to gate access at finer resolution than the Role hierarchy — for example, an AI-agent Service might be granted VaultRead against a specific context but never VaultWrite or Sign. Wire form (kebab-case) matches the canonical Capability shared schema.

For legacy rows with no capability set, derived_capabilities_for_role produces a sensible default from the existing role (Admin gets everything, Reader gets only vault-read, etc.) so existing ACL behaviour is preserved bit-for-bit.

Variants

VaultRead

VaultWrite

ProxyLogin

FillRelease

PolicyAdmin

DeviceAdmin

Sign

KeyMint

SignTrustTask

Per-envelope Trust Task signing via vault/sign-trust-task/0.1 — distinct from ProxyLogin (which mints a session credential) and from Sign (the generic signing oracle). Keeping it separate lets operators grant proxy-login without sign-trust-task to limit blast radius on Service consumers (AI agents, etc.).

CredentialWrite

Mutating the archival lifecycle of a stored credential — the vault/credentials/{archive,unarchive,delete,restore,purge}/0.1 tasks. Distinct from VaultWrite (which gates vault/credentials/ receive and the password-vault writes) so an operator can grant a consumer the ability to receive credentials without the ability to remove them — removal of a holder’s credentials is a higher-trust action. Granted to the same roles that hold VaultWrite.

Trait Implementations

impl Clone for Capability

fn clone(&self) -> Capability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Capability

impl Debug for Capability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Capability

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Capability

impl Hash for Capability

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for Capability

fn eq(&self, other: &Capability) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Capability

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Capability