Documentation
¶
Overview ¶
Package policy provides administrative governance over safety rules.
Policies wrap reflexes for admin management. They define tenant-scoped safety rules that can be assigned and cascaded (app-level policies apply globally, org/tenant policies are additive).
Index ¶
Constants ¶
const ( // ConditionPIIDetected holds when the scan found personal data. ConditionPIIDetected = "pii_detected" // ConditionSecretDetected holds when the scan found a secret. ConditionSecretDetected = "secret_detected" // ConditionFinding holds when the rule's check type has a finding. ConditionFinding = "finding" // ConditionScore compares the highest finding score of the rule's // check type with a number: "score >= 0.9". ConditionScore = "score" )
Condition kinds a rule can test.
Variables ¶
var ErrInvalidCondition = errors.New("policy: invalid condition")
ErrInvalidCondition reports a rule condition outside the grammar.
Functions ¶
This section is empty.
Types ¶
type Condition ¶
type Condition struct {
Kind string // one of the Condition constants
Op string // ConditionScore only: >, >=, < or <=
Value float64 // ConditionScore only
}
Condition is a parsed rule condition.
func ParseCondition ¶
ParseCondition parses a rule condition: pii_detected, secret_detected, finding, or score followed by >, >=, < or <= and a number. Spaces around the parts do not matter.
type ListFilter ¶
type ListFilter struct {
ScopeKey string
ScopeLevel ScopeLevel
Enabled *bool
Limit int
Offset int
}
ListFilter defines filtering for policy list queries.
type Policy ¶
type Policy struct {
shield.Entity
ID id.PolicyID `json:"id" bun:",pk"`
Name string `json:"name" bun:",notnull"`
Description string `json:"description,omitempty"`
ScopeKey string `json:"scope_key" bun:",notnull"`
ScopeLevel ScopeLevel `json:"scope_level" bun:",notnull"`
Rules []Rule `json:"rules" bun:"type:jsonb"`
Enabled bool `json:"enabled" bun:",notnull,default:true"`
Metadata map[string]any `json:"metadata,omitempty" bun:"type:jsonb"`
}
Policy defines safety rules that can be assigned to tenants.
type Rule ¶
type Rule struct {
CheckType string `json:"check_type"` // "instinct", "awareness", "values", "judgment", etc.
Condition string `json:"condition"` // "score > 0.8", "pii_detected", etc.
Action string `json:"action"` // "block", "flag", "redact"
ErrorMessage string `json:"error_message,omitempty"` // custom error message for blocks
Priority int `json:"priority,omitempty"`
}
Rule defines a specific enforcement rule within a policy.
type ScopeLevel ¶
type ScopeLevel string
ScopeLevel defines the scope at which a policy operates.
const ( ScopeApp ScopeLevel = "app" ScopeOrg ScopeLevel = "org" )
type Store ¶
type Store interface {
CreatePolicy(ctx context.Context, pol *Policy) error
GetPolicy(ctx context.Context, polID id.PolicyID) (*Policy, error)
GetPolicyByName(ctx context.Context, scopeKey, name string) (*Policy, error)
UpdatePolicy(ctx context.Context, pol *Policy) error
DeletePolicy(ctx context.Context, polID id.PolicyID) error
ListPolicies(ctx context.Context, filter *ListFilter) ([]*Policy, error)
GetPoliciesForScope(ctx context.Context, scopeKey string, level ScopeLevel) ([]*Policy, error)
AssignToTenant(ctx context.Context, tenantID string, polID id.PolicyID) error
UnassignFromTenant(ctx context.Context, tenantID string, polID id.PolicyID) error
}
Store defines persistence operations for policies.
Source Files