Struct PolicyCompiler 

pub struct PolicyCompiler<'a> { /* private fields */ }

Compose layers in system → application → tenant order. Every ordinary layer intersects the previous snapshot; only authorize_replacement can relax it.

Implementations

impl<'a> PolicyCompiler<'a>

pub fn new( profile: PolicyProfile, provider: &'a dyn CryptoProvider, authorization: Option<PolicyValidity>, ) -> Result<Self, PolicyViolation>

Construct a named profile using this engine’s advertised capabilities. LegacyVerify requires a valid authorization even before compilation.

pub fn restrict(self, layer: &PolicySet) -> Result<Self, PolicyViolation>

Intersect another complete layer without granting any new permission. None operation fields mean disabled, not unspecified inheritance.

pub fn authorize_replacement( self, replacement: PolicySet, authorization: PolicyValidity, ) -> Result<Self, PolicyViolation>

Explicit relaxation path: replace the effective policy and retain the authenticated grant on every enabled operation. Earlier authorization lifetimes are intersected, so replacement cannot extend an existing grant.

pub fn compile( self, context: &PolicyCompileContext, ) -> Result<CompiledPolicies, PolicyViolation>

Compile contradictions before parsing, resolver calls or cryptography.

pub fn policies(&self) -> &PolicySet

Inspect a layer input for customization before restrictive composition.