Struct GrantPolicy 

pub struct GrantPolicy {
    pub policy_id: String,
    pub workspace_root: String,
    pub effect_ceiling: Vec<EffectKind>,
    pub path_ceiling: Vec<PathPattern>,
    pub command_ceiling: Vec<CommandPattern>,
    pub network_ceiling: Vec<NetworkPattern>,
    pub approval_ceiling: ApprovalPolicy,
    pub authority_epoch: u64,
    pub persistent: bool,
    pub integrity_binding: String,
}

Durable authorization intent. A resume re-mints a fresh live capability from this policy and current workspace facts; the capability itself is deliberately not serializable.

Fields

policy_id: String

workspace_root: String

effect_ceiling: Vec<EffectKind>

path_ceiling: Vec<PathPattern>

command_ceiling: Vec<CommandPattern>

network_ceiling: Vec<NetworkPattern>

approval_ceiling: ApprovalPolicy

authority_epoch: u64

persistent: bool

integrity_binding: String

Content binding recorded in the session ledger. Persistent policies require a separate cryptographic signature before cross-session use.

Implementations

impl GrantPolicy

pub fn mint(&self, requested: Capability) -> Result<Capability>

Mint a live capability as the intersection of a requested template with this policy’s ceilings (PSP-9 resolved decision 6). Fails closed: an empty effect intersection is an error, never an unlimited grant.

The approval ceiling governs durable delivery. A Worker-role request confined to the reversible candidate overlay may keep Auto inside an Ask ceiling, because nothing it does becomes durable without the separate promotion approval; every other role is clamped to the stricter policy.

pub fn canonical_bytes(&self) -> Vec<u8>

The deterministic byte encoding the grant signature commits to.

serde output is not canonical (field order, float and escape formatting may change across versions), so the signature covers this fixed, length-prefixed encoding instead. Every field participates; list fields are count-prefixed so no concatenation can alias two policies.

Trait Implementations

impl Clone for GrantPolicy

fn clone(&self) -> GrantPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GrantPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for GrantPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for GrantPolicy

fn eq(&self, other: &GrantPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for GrantPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for GrantPolicy