Module policy 

Heterogeneous security — PolicyEngine trait and data types .

This layer is the abstraction over the governance-XML stack. The v1.4 state (crate::SharedSecurityGate) decides one protection level per participant. System-of-systems deployments (vehicle, tactical, edge) need finer granularity on the triple axis (peer, topic, interface).

PolicyEngine encapsulates this decision:

• PolicyEngine::outbound_decision is called per matched reader before a wire packet is written.
• PolicyEngine::inbound_decision is called per incoming datagram.
• PolicyEngine::accept_peer is the admission check during SEDP matching.

The default implementation (crate::GovernancePolicyEngine, in stage 1c) mirrors the current SharedSecurityGate semantics 1:1. Users can plug in their own PolicyEngine impls, e.g. to derive decisions from an external policy server or a vehicle-network certification database.

See docs/architecture/08_heterogeneous_security.md §3.1.

Structs

InboundCtx

Inbound decision context: a datagram has come in.

InterfaceConfig

Runtime configuration of the interface classifier.

IpRange

CIDR-like IPv4/IPv6 range, interpreted inclusively.

OutboundCtx

Outbound decision context: a writer sends to a peer.

PolicyDecision

Decision of the PolicyEngine for a concrete packet/peer/interface triple.

Enums

NetInterface

Classification of a network interface for the policy decision.

ProtectionLevel

Abstract protection level for the policy layer.

SuiteHint

Crypto-suite hint for the policy decision.

Traits

PolicyEngine

Policy engine: decides the protection level for a concrete (peer, topic, interface) triple.

Functions

classify_interface

Classifies an IP address into the NetInterface taxonomy.