Struct SecurityConfig 

pub struct SecurityConfig {

    pub redact_secrets: bool,
    pub autonomy_level: AutonomyLevel,
    pub content_isolation: ContentIsolationConfig,
    pub exfiltration_guard: ExfiltrationGuardConfig,
    pub memory_validation: MemoryWriteValidationConfig,
    pub pii_filter: PiiFilterConfig,
    pub rate_limit: RateLimitConfig,
    pub pre_execution_verify: PreExecutionVerifierConfig,
    pub guardrail: GuardrailConfig,
    pub response_verification: ResponseVerificationConfig,
    pub causal_ipi: CausalIpiConfig,
    pub vigil: VigilConfig,
    pub trajectory: TrajectorySentinelConfig,
    pub capability_scopes: CapabilityScopesConfig,
    pub shadow_sentinel: ShadowSentinelConfig,
}

Agent security configuration, nested under [security] in TOML.

Aggregates all security-related subsystems: content isolation, exfiltration guards, memory write validation, PII filtering, rate limiting, prompt injection screening, and response verification.

Example (TOML)

[security]
redact_secrets = true
autonomy_level = "moderate"

[security.rate_limit]
enabled = true
shell_calls_per_minute = 20

Fields

redact_secrets: bool

Automatically redact detected secrets from tool outputs before they reach the LLM. Default: true.

autonomy_level: AutonomyLevel

Autonomy level controlling which tool actions require explicit user confirmation.

content_isolation: ContentIsolationConfig

exfiltration_guard: ExfiltrationGuardConfig

memory_validation: MemoryWriteValidationConfig

Memory write validation (enabled by default).

pii_filter: PiiFilterConfig

PII filter for tool outputs and debug dumps (opt-in, disabled by default).

rate_limit: RateLimitConfig

Tool action rate limiter (opt-in, disabled by default).

pre_execution_verify: PreExecutionVerifierConfig

Pre-execution verifiers (enabled by default).

guardrail: GuardrailConfig

LLM-based prompt injection pre-screener (opt-in, disabled by default).

response_verification: ResponseVerificationConfig

Post-LLM response verification layer (enabled by default).

causal_ipi: CausalIpiConfig

Temporal causal IPI analysis at tool-return boundaries (opt-in, disabled by default).

vigil: VigilConfig

VIGIL verify-before-commit intent anchoring gate (enabled by default).

Runs a regex tripwire before sanitize_tool_output to intercept low-effort injection patterns. See [[security.vigil]] in TOML and spec 010-6-vigil-intent-anchoring.

trajectory: TrajectorySentinelConfig

Trajectory risk sentinel configuration.

Controls signal decay, risk level thresholds, auto-recovery, and subagent inheritance. See spec 050 and crates/zeph-core/src/agent/trajectory.rs.

capability_scopes: CapabilityScopesConfig

Capability scope configuration.

Maps task-type names to glob-pattern allow-lists over fully-qualified tool ids. When empty, scoping is a no-op (full tool set surfaced to LLM).

shadow_sentinel: ShadowSentinelConfig

ShadowSentinel Phase 2: persistent safety event stream + LLM pre-execution probe.

Disabled by default. When enabled, high-risk tool calls are probed by an LLM before execution. ShadowSentinel is defence-in-depth only — PolicyGateExecutor and TrajectorySentinel remain the primary enforcement mechanisms.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.