Documentation
¶
Overview ¶
Package inboundpolicy evaluates a per-agent inbound trust policy (api-v1-redesign decision 10 / Slice 7). It is gateway-ENFORCED, not advisory guidance an agent author can skip.
Two orthogonal axes compose (decision 10 says the postures "compose", which a single enum can't express):
- Ingestion gate (this package): inbound_policy ∈ {open, allowlist, domain}. Decides, on arrival, whether a message is trusted or FLAGGED. Flagged messages are still delivered (never dropped) + emit email.flagged so nothing disappears and operators get a signal. (A DMARC-alignment "verified_only" posture was removed pre-GA; it may return as an additive policy later.)
- Action gate (the protection policy): holds suspicious outbound as pending_review, configured via the agent's outbound gate action / content scan (the old hitl_enabled flag was retired).
This package is a stdlib-only leaf: it takes primitives (policy, allowlist, sender, the DMARC verdict string) so callers (relay, store) don't couple to emailauth/identity.
Index ¶
Constants ¶
const ( // Open accepts all inbound; no flagging. The default. Open = "open" // Allowlist accepts only senders whose exact address is on inbound_allowlist; // others are flagged (a TRUST gate — known senders). Allowlist = "allowlist" // Domain accepts only senders whose domain is on inbound_allowlist; others // are flagged (a TRUST gate — known domains). Domain = "domain" )
Ingestion policy values (the inbound_policy column).
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Decision ¶
Decision is the ingestion verdict for one inbound message.
func EvaluateIngestion ¶
func EvaluateIngestion(policy string, allowlist []string, senderEmail string, senderResolvable bool, dmarcStatus string) Decision
EvaluateIngestion applies the agent's ingestion policy to an inbound message.
- policy: the agent's inbound_policy (unknown/empty → treated as Open).
- allowlist: the agent's inbound_allowlist (addresses for Allowlist, domains for Domain); matching is case-insensitive.
- senderEmail: the message's display sender (From identity).
- senderResolvable: whether senderEmail maps to a SPECIFIC authenticated sender. False for mail relayed under the shared "via e2a" address, which authenticates (DMARC passes for the relay domain) but carries no per-agent identity (#299). An unresolvable sender can never legitimately satisfy a per-agent allowlist/domain gate, so it is treated as a non-match. Open is unaffected — open means open.
Flagged is fail-closed for the gating postures: an empty/garbage sender, an empty allowlist, or an unresolvable sender flags everything (you opted into a gate but the sender cannot be matched).
Source Files