Struct SecurityConfig 

pub struct SecurityConfig {
    pub nat64_prefixes: Vec<String>,
    pub audit: AuditConfig,
    pub leak_detection: LeakDetectionConfig,
    pub otp: OtpConfig,
    pub estop: EstopConfig,
    pub nevis: NevisConfig,
    pub webauthn: WebAuthnConfig,
}

Security configuration for audit logging, OTP, e-stop, IAM/SSO, WebAuthn, and the host’s NAT64 egress boundary.

Sandbox backend and resource limits live on per-agent risk profiles (see RiskProfileConfig::sandbox_* and RiskProfileConfig::max_*); the runtime resolves them via Config::active_risk_profile(agent_alias).

Fields

nat64_prefixes: Vec<String>

Network-specific RFC 6052 NAT64 prefixes deployed on this host’s network, for example [security] nat64_prefixes = ["2001:db8:122:344::/96"]. Default: [].

A NAT64 translator delivers any IPv6 destination inside one of these prefixes to the IPv4 address embedded in it. The prefix is an organization’s own choice and nothing in the address reveals it, so without this list an attacker-controlled hostname can resolve to an apparently-global IPv6 address that the local translator maps to 10.0.0.1 or 169.254.169.254, and the outbound SSRF checks accept it. Declaring the prefixes in use makes the address they translate to part of the validation boundary for http_request, web_fetch, and text_browser.

Each entry is <ipv6>/<length> with one of RFC 6052 §2.2’s lengths — 32, 40, 48, 56, 64, or 96 — and no bits set beyond that length. A malformed entry fails construction of the tools that read this list rather than being skipped, so a typo cannot silently narrow the boundary.

The default is correct for deployments that run no NAT64 translator and for those that use only the well-known 64:ff9b::/96 prefix, which is classified without configuration.

RFC 8215 also standardizes 64:ff9b:1::/48 as the local-use NAT64 block, and it still needs declaring. The public-address validator already denies the whole block as non-global, so the default is safe on its own. But that non-global check is precisely what the private-host opt-in relaxes, and the metadata gate that remains unconditional underneath it decodes only the well-known /96, not this block. A deployment that translates from 64:ff9b:1::/48 must therefore declare the specific prefix it uses here; otherwise, once a host is allowed through allowed_private_hosts, an address in that block reaches the translator’s embedded IPv4 destination without that destination being classified.

Declared prefixes may overlap, and an address inside several of them decodes to a different IPv4 destination under each. Validation is conservative: an address is accepted only when every declared translation it matches lands somewhere acceptable, so a nested prefix that decodes an address to a private or metadata destination denies it even when a broader prefix decodes the same address globally. If that refuses destinations you consider legitimate, narrow the declared prefixes to the translations actually deployed.

audit: AuditConfig

Audit logging configuration

leak_detection: LeakDetectionConfig

Outbound credential leak detection and redaction configuration. See [security.leak_detection] for the detector controls.

otp: OtpConfig

OTP gating configuration for sensitive actions/domains.

estop: EstopConfig

Emergency-stop state machine configuration.

nevis: NevisConfig

Nevis IAM integration for SSO/MFA authentication and role-based access.

webauthn: WebAuthnConfig

WebAuthn / FIDO2 hardware key authentication configuration.

Implementations

impl SecurityConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn init_requires_explicit_config() -> bool

True when this struct has a required leaf field that a bare/ancestor-prefix init_defaults scaffold must not materialize (it would fill the field with its Rust Default, which prune_empty_leaves then strips on save, leaving a partial sub-table that fails strict reload). Explicitly targeting this section (or a descendant of it) still scaffolds regardless of this flag, so the section can be materialized for the operator to fill in.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<(), Error>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String, Error>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<(), Error>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<SecurityConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SecurityConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for SecurityConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &SecurityConfig)

impl Serialize for SecurityConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.