Struct ResolvedGrants 

#[non_exhaustive]
pub struct ResolvedGrants {
    pub admin: bool,
    pub allowed_agents: Vec<AgentAlias>,
    pub config_write_paths: Vec<String>,
    pub allowed_tools: Vec<String>,
    pub resources: BTreeMap<Resource, BTreeSet<Verb>>,
}

The merged authorization result for one principal: what it may touch and how. Produced by the shared grant resolver from permission profiles at a specific authorization-policy generation; consumed by dispatch classification, the gateway router, and deep resource checks. Never stored on a Principal — consumers re-resolve when the generation changes.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

admin: bool

Full access to everything. Short-circuits all other checks. An explicit administrator grant dominates the ordinary grant set.

allowed_agents: Vec<AgentAlias>

Agent aliases this principal may bind or address. Empty = none; broad access requires the explicit WILDCARD entry.

config_write_paths: Vec<String>

Dotted config path prefixes this principal may write. A trailing .* grants the subtree; a bare path grants that exact prop; the WILDCARD entry grants every path. Empty = none.

allowed_tools: Vec<String>

Tool names this principal may cause an agent to run. Empty = none; broad access requires the explicit WILDCARD entry. (The agent’s own tool policy still applies on top.)

resources: BTreeMap<Resource, BTreeSet<Verb>>

Resource-class grants: which verbs are permitted per resource. Missing resource = deny.

Implementations

impl ResolvedGrants

pub fn none() -> Self

The deny-everything grant set (the Default).

pub fn all() -> Self

The allow-everything grant set (admin). Used for the shared-operator sentinel so legacy single-operator deployments keep today’s behaviour.

pub fn permits(&self, resource: Resource, verb: Verb) -> bool

Whether this grant set permits verb on resource.

pub fn may_use_agent(&self, alias: &str) -> bool

Whether this principal may bind or address the given agent alias. An empty selector list grants no agents; broad access requires the explicit WILDCARD entry or admin.

pub fn may_use_tool(&self, tool: &str) -> bool

Whether this principal may cause the named tool to run. An empty selector list grants no tools; broad access requires the explicit WILDCARD entry or admin.

pub fn may_write_config(&self, path: &str) -> bool

Whether this principal may write the given dotted config path. A granted foo.* covers foo itself and every descendant; a granted bare foo.bar covers exactly that prop; the WILDCARD entry covers every path. Empty = none.

pub fn merge(&mut self, other: &Self)

Merge another grant set into this one — the deterministic monotonic union used when one identity maps to multiple permission profiles. No implicit deny rules, no profile-order precedence; admin from either side dominates.

Trait Implementations

impl Clone for ResolvedGrants

fn clone(&self) -> ResolvedGrants

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ResolvedGrants

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ResolvedGrants

fn default() -> ResolvedGrants

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ResolvedGrants

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ResolvedGrants

impl PartialEq for ResolvedGrants

fn eq(&self, other: &ResolvedGrants) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ResolvedGrants

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ResolvedGrants