Documentation
¶
Index ¶
Constants ¶
const DefaultPollInterval = 2 * time.Second
DefaultPollInterval is how often the watcher checks for policy file changes. TODO(perf): Replace polling with fsnotify for instant reload and zero CPU overhead. Polling at DefaultPollInterval is acceptable for single-file watching but won't scale to directory watching.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ActionRequest ¶
type ActionRequest struct {
Scope string `json:"scope"`
Action string `json:"action,omitempty"`
Command string `json:"command,omitempty"`
Path string `json:"path,omitempty"`
Domain string `json:"domain,omitempty"`
URL string `json:"url,omitempty"`
AgentID string `json:"agent_id,omitempty"`
SessionID string `json:"session_id,omitempty"`
EstCost float64 `json:"est_cost,omitempty"`
Meta map[string]string `json:"meta,omitempty"`
}
ActionRequest represents an agent's intended action.
type AgentCfg ¶
type AgentCfg struct {
Extends string `yaml:"extends"`
Override []RuleSet `yaml:"override,omitempty"`
}
AgentCfg defines per-agent policy overrides.
type CheckResult ¶
type CheckResult struct {
Decision Decision `json:"decision"`
Reason string `json:"reason"`
Rule string `json:"matched_rule,omitempty"`
ApprovalID string `json:"approval_id,omitempty"`
ApprovalURL string `json:"approval_url,omitempty"`
}
CheckResult is the response returned after evaluating an action against policy.
type Condition ¶
type Condition struct {
RequirePrior string `yaml:"require_prior,omitempty"`
TimeWindow string `yaml:"time_window,omitempty"`
}
Condition is a contextual constraint on a rule.
type CostLimits ¶
type CostLimits struct {
MaxPerAction string `yaml:"max_per_action,omitempty"`
MaxPerSession string `yaml:"max_per_session,omitempty"`
AlertThreshold string `yaml:"alert_threshold,omitempty"`
}
CostLimits defines cost guardrails for a scope.
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine evaluates actions against a policy.
func (*Engine) Check ¶
func (e *Engine) Check(req ActionRequest) CheckResult
Check evaluates an action request against the active policy. Order: deny rules -> require_approval rules -> allow rules -> default deny. Per-agent overrides are applied when AgentID matches a key in policy.Agents.
func (*Engine) RateLimitConfig ¶
func (e *Engine) RateLimitConfig(scope, agentID string) *RateLimitCfg
RateLimitConfig returns the rate limit config for a given scope, considering per-agent overrides. Returns nil if no rate limit is configured.
func (*Engine) UpdatePolicy ¶
UpdatePolicy hot-swaps the active policy.
type FileWatcher ¶
type FileWatcher struct {
// contains filtered or unexported fields
}
FileWatcher watches a policy file for changes and triggers a callback.
type NotificationCfg ¶
type NotificationCfg struct {
ApprovalRequired []NotifyTarget `yaml:"approval_required,omitempty"`
OnDeny []NotifyTarget `yaml:"on_deny,omitempty"`
}
NotificationCfg defines where to send alerts.
type NotifyTarget ¶
type NotifyTarget struct {
Type string `yaml:"type"` // "webhook", "slack", "console", "log"
URL string `yaml:"url,omitempty"`
Level string `yaml:"level,omitempty"`
}
NotifyTarget is a notification destination.
type Policy ¶
type Policy struct {
Version string `yaml:"version"`
Name string `yaml:"name"`
Description string `yaml:"description"`
Rules []RuleSet `yaml:"rules"`
Agents map[string]AgentCfg `yaml:"agents,omitempty"`
Notifications NotificationCfg `yaml:"notifications,omitempty"`
}
Policy is the top-level policy document.
func LoadFromFile ¶
LoadFromFile reads and parses a policy YAML file.
func (*Policy) ScopeCount ¶
ScopeCount returns the number of unique scopes.
type RateLimitCfg ¶
RateLimitCfg defines rate limiting parameters.
type Rule ¶
type Rule struct {
Action string `yaml:"action,omitempty"`
Pattern string `yaml:"pattern,omitempty"`
Paths []string `yaml:"paths,omitempty"`
Domain string `yaml:"domain,omitempty"`
Message string `yaml:"message,omitempty"`
Conditions []Condition `yaml:"conditions,omitempty"`
}
Rule is an individual policy rule.
type RuleSet ¶
type RuleSet struct {
Scope string `yaml:"scope"`
Allow []Rule `yaml:"allow,omitempty"`
Deny []Rule `yaml:"deny,omitempty"`
RequireApproval []Rule `yaml:"require_approval,omitempty"`
RateLimit *RateLimitCfg `yaml:"rate_limit,omitempty"`
Limits *CostLimits `yaml:"limits,omitempty"`
}
RuleSet groups rules by scope.
Source Files