openagent-claude-agent · policy

Source: openagent-sdk/integrations/claude-agent-sdk/rust/src/policy.rs. SHA-256: 6cd87a54d42dfa671bac1443a09d0d1b7555f810e604c4866440a6131dde8097.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

policy::TOOL_SCOPE_PREFIX

Canonical scope prefix for tool invocations.

pub const TOOL_SCOPE_PREFIX: &str;

Source line: 12.

policy::SKILL_SCOPE_PREFIX

Canonical scope prefix for skill invocations.

pub const SKILL_SCOPE_PREFIX: &str;

Source line: 15.

policy::tool_scope

Build a canonical scope string for a tool name.

#[must_use]
pub fn tool_scope(name: &str) -> String;

Source line: 19.

policy::skill_scope

Build a canonical scope string for a skill name.

#[must_use]
pub fn skill_scope(name: &str) -> String;

Source line: 25.

policy::ScopeDecision

Result of a single scope check.

#[derive(Debug, Clone)]
pub struct ScopeDecision {
/// Whether the request is allowed.

pub allowed: bool,
/// Matched scope string (if any).

pub matched_scope: Option<String>,
/// Human-readable reason for denial.

pub reason: Option<String>
}

Source line: 31.

policy::ScopeDecision::allow

Build an allow decision.

pub fn allow(matched: impl Into<String>) -> Self;

Source line: 42.

policy::ScopeDecision::deny

Build a deny decision.

pub fn deny(reason: impl Into<String>) -> Self;

Source line: 51.

policy::CapabilityChecker

Trait implemented by anything that can authorise scope requests.

#[async_trait]
pub trait CapabilityChecker: Send + Sync {
    /// Check whether the agent currently holds the requested scope.
    async fn check(&self, scope: &str) -> Result<ScopeDecision>;
}

Source line: 62.

policy::StaticCapabilityChecker

Static capability checker backed by a fixed allow-list.

Supports literal scopes and one wildcard form: any entry ending in * matches anything starting with the prefix preceding the *.

#[derive(Debug, Default)]
pub struct StaticCapabilityChecker {

}

Source line: 72.

policy::StaticCapabilityChecker::new

Construct a checker from an iterator of scope strings.

pub fn new<I, S>(scopes: I) -> Self
    where
        I: IntoIterator<Item = S>,
        S: Into<String>,;

Source line: 79.

policy::SkillDecision

Decision returned by [SkillsPolicy].

#[derive(Debug, Clone)]
pub struct SkillDecision {
/// Allow / deny.

pub allowed: bool,
/// Reason on deny.

pub reason: Option<String>,
/// Matched scope on allow.

pub matched_scope: Option<String>
}

Source line: 115.

policy::SkillsPolicy

Skills policy: gates SKILLS.md skill invocations.

#[async_trait]
pub trait SkillsPolicy: Send + Sync {
    /// Evaluate whether the named skill may be invoked by the current agent.
    async fn evaluate(
        &self,
        skill_name: &str,
        identity: &dyn OpenAgentIdentity,
        capabilities: &dyn CapabilityChecker,
    ) -> Result<SkillDecision>;
}

Source line: 126.

policy::DenyUnlessScopedSkillsPolicy

Default policy: deny unless the agent holds skills:invoke:<name>.

#[derive(Debug, Default, Clone, Copy)]
pub struct DenyUnlessScopedSkillsPolicy;

Source line: 138.

policy::AllowListSkillsPolicy

Allow-list skills policy: only listed skills are permitted, and the inner policy (defaults to [DenyUnlessScopedSkillsPolicy]) must also allow the call.

pub struct AllowListSkillsPolicy {

}

Source line: 173.

policy::AllowListSkillsPolicy::new

Construct a new allow-list policy.

pub fn new<I, S>(allowed: I, inner: Option<Arc<dyn SkillsPolicy>>) -> Self
    where
        I: IntoIterator<Item = S>,
        S: Into<String>,;

Source line: 180.

policy::OpenAgentSdkSkillsPolicy

Adapter that bridges the OpenAgent SDK's SkillsPolicy (synchronous, owned by an OpenAgent) into this crate's async [SkillsPolicy].

Use this when you've already configured a skills policy on an openagent_sdk::OpenAgent (e.g., via with_skills_policy) and want the same policy to gate Claude Agent SDK skill invocations.

pub struct OpenAgentSdkSkillsPolicy {

}

Source line: 217.

policy::OpenAgentSdkSkillsPolicy::new

Wrap an openagent_sdk::SkillsPolicyHandle.

pub fn new(inner: openagent_sdk::SkillsPolicyHandle) -> Self;

Source line: 223.

policy::CompositeSkillsPolicy

Composite policy: every inner policy must allow.

pub struct CompositeSkillsPolicy {

}

Source line: 252.

policy::CompositeSkillsPolicy::new

Construct a composite policy from a Vec of inner policies.

pub fn new(policies: Vec<Arc<dyn SkillsPolicy>>) -> Self;

Source line: 258.