policy

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: MIT Imports: 5 Imported by: 0

Documentation

Overview

Package policy decides whether a tool call is allowed, denied, or needs human approval. Decisions are deny-by-default: anything not explicitly permitted by the mode and tool rules is refused.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ValidTarget 

func ValidTarget(t string) bool

ValidTarget reports whether a user-supplied target name is safe to pass on.

Types

type Class 

type Class int

Class describes what a tool does to the target system. 

const (
	// Observe tools only read state.
	Observe Class = iota
	// Mutate tools change state (restart services, etc.).
	Mutate
	// Shell tools run freeform commands. Disabled unless opted in.
	Shell
)

type Decision 

type Decision int

Decision is the outcome of a policy check. 

const (
	Deny Decision = iota
	Allow
	NeedsApproval
)

func (Decision) String 

func (d Decision) String() string

type Engine 

type Engine struct {
	// contains filtered or unexported fields
}

Engine evaluates tool calls against the loaded config.

func New 

func New(cfg *config.Config) *Engine

func (*Engine) Check 

func (e *Engine) Check(host, tool string, class Class, target string) (Decision, string)

Check returns the decision for calling tool (of class) against target on host. target may be empty for tools that take no target (e.g. disk_usage).

func (*Engine) Enabled 

func (e *Engine) Enabled(tool string, class Class) bool

Enabled reports whether a tool should be registered at all.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.