Enum Resource 

pub enum Resource {
    Cards,
    Services,
    Operators,
    Verifier,
    Drift,
    Artifacts,
    Audit,
    Policy,
    Triggers,
    ServiceAccounts,
    Users,
    IdentityConnections,
    Tenants,
    PlatformIdentity,
    PlatformCredentials,
    BifrostTable,
    BifrostRecord,
    BifrostQuery,
    BifrostPeer,
    Gateway,
    GatewayPayload,
    Tool,
    AnyOf(Vec<Resource>),
    Wildcard,
}

Resource the permission applies to.

Variants

Cards

Cards and specs.

Services

Service cards and deployment-facing service operations.

Operators

Operator cards and invocations.

Verifier

Explicit invocation of a Verifier Card, optionally scoped to one UID.

Drift

Drift-backed Verifier Cards and drift observations.

Artifacts

Artifact bytes and metadata.

Audit

Audit records and audit cards.

Policy

Policy cards and policy administration.

Triggers

Trigger cards.

ServiceAccounts

Service and agent API-key principals.

Users

Human user administration.

IdentityConnections

The tenant’s human OIDC login connection: staging, testing, activating, deactivating, and removing the provider its people sign in through.

Separate from Resource::ServiceAccounts so that holding credential administration alone never confers authority over who may sign in to the tenant. The built-in admin role reaches it through its wildcard; no other built-in role grants it.

Tenants

The tenant directory itself: creating, inspecting, suspending, and recovering administration for a tenant.

This is a platform-control-plane resource. It governs the lifecycle of a tenant, never the resources inside one, so holding it grants no access to any tenant’s data.

PlatformIdentity

The deployment’s platform-scope human identity: its one OIDC connection and the human platform principals registered against it.

A platform-control-plane resource, distinct from Resource::Tenants so that administering who may sign in to the platform is visible in a grant and in audit separately from administering tenants. Holding it grants no access to any tenant’s data.

PlatformCredentials

Platform-scope credentials: the secrets that authenticate a platform principal to the control plane.

Separate from Resource::PlatformIdentity because the two answer different questions. Identity administration decides who the platform recognizes; credential administration mints and retires the secrets that prove it. An operator may need to rotate the deployment’s root credential without also being able to register new administrators.

BifrostTable

Bifrost table definitions (DDL: create/list/describe).

BifrostRecord

Bifrost record ingest (the streaming write surface).

BifrostQuery

Bifrost table reads (SQL/scan).

BifrostPeer

Private Bifrost peer plane: reservation, execution, tail, and lifecycle.

Role-neutral on purpose. Every peer-bearing target answers the same private services, so a Scribe and an Oracle are authorized by the same permission rather than by role-specific resources.

Gateway

Gateway administration (provider credentials, deployments, policies) and deployment/model invocation.

GatewayPayload

Captured gateway request and response payload fields.

Tool

Built-in Agent tool invocation, optionally scoped to one tool.

Invocation authority only: a tool’s underlying Cards or Bifrost access is checked separately against those resources, and holding them never implies this one.

AnyOf(Vec<Resource>)

One of several resources.

Wildcard

All resources.

Implementations

impl Resource

pub fn covers(&self, other: &Resource) -> bool

True if this resource covers other.

pub const fn accepts_bifrost_scope(&self) -> bool

True when this resource owns Bifrost objects a grant may be scoped to.

Bifrost query reads and record writes name a table. AnyOf and Wildcard are deliberately excluded: a multi-resource or wildcard grant reaches objects only through PermissionScope::All.

pub fn as_str(&self) -> Option<&'static str>

Stable label for this resource, or None for a composite AnyOf.

Audit records the label rather than the enum’s debug shape so a stored decision stays readable and comparable across releases.

Trait Implementations

impl Clone for Resource

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Resource

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Resource

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Resource

impl Hash for Resource

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for Resource

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Resource

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Resource