v1

Module: v1

Contents

Modules

• audit_service_client - Generated client implementations.
• audit_service_server - Generated server implementations.
• authority_service_client - Generated client implementations.
• authority_service_server - Generated server implementations.
• execution_intent - Nested message and enum types in ExecutionIntent.
• get_approval_outcome_response - Nested message and enum types in GetApprovalOutcomeResponse.

Structs

• CapabilityToken - CapabilityToken represents a signed, scoped, time-bounded permission
• ConnectorResponse - ConnectorResponse wraps the response from an external system after
• DbQueryParams - DbQueryParams carries parameters for a database query action.
• DeniedApproval - DeniedApproval: an operator denied the request. Terminal; no token exists.
• ExecutionEnvelope - ExecutionEnvelope is the core protocol unit of the Firma system.
• ExecutionEvent - ExecutionEvent is the immutable audit record for a single enforcement
• ExecutionIntent - ExecutionIntent describes the action the agent wants to perform.
• ExecutionMetadata - ExecutionMetadata carries session and runtime context for an execution.
• ExpiredApproval - ExpiredApproval: the request expired before a decision. Terminal; no token
• GetApprovalOutcomeRequest - GetApprovalOutcomeRequest polls the outcome of one pending approval.
• GetApprovalOutcomeResponse - GetApprovalOutcomeResponse carries exactly one pending or terminal outcome.
• GrantedApproval - GrantedApproval: an operator approved the request and the Authority issued
• HttpParams - HttpParams carries parameters for an HTTP action.
• IssueCapabilityRequest - IssueCapabilityRequest carries the agent’s identity and requested scope
• IssueCapabilityResponse - IssueCapabilityResponse returns the outcome of an issuance evaluation: a
• PendingApproval - PendingApproval: no decision yet; poll again.
• PolicyBundle - PolicyBundle is the set of Cedar policy files distributed from
• PolicyBundleUpdate - PolicyBundleUpdate wraps a policy bundle push from Authority to Sidecar.
• RevocationEvent - RevocationEvent signals the invalidation of a previously issued
• SidecarCredentials - SidecarCredentials are the credentials a Sidecar presents on every Authority
• StreamEventsResponse - StreamEventsResponse is returned when the client half-closes the stream.
• ToolUseParams - ToolUseParams carries parameters for an agent tool invocation.
• WatchPolicyBundleRequest - WatchPolicyBundleRequest initiates a policy bundle subscription.
• WatchRevocationsRequest - WatchRevocationsRequest initiates a revocation event subscription.

Enums

• EnforcementDecision - EnforcementDecision is the outcome of Sidecar evaluation. Conforms to
• IssueDecision - IssueDecision is the tri-state outcome of an IssueCapability evaluation.
• TokenFormat - TokenFormat identifies the encoding format of a capability token.

---

firma_protobuf::v1::CapabilityToken

Struct

CapabilityToken represents a signed, scoped, time-bounded permission granted to an agent for a specific action class.

Issued by the Authority before execution begins. Defines the permission perimeter: the Sidecar enforces constraints within it but cannot extend or override it.

Fields:

• token_id: ::prost::alloc::string::String - Unique identifier for tracking and revocation lookups.
• agent_id: ::prost::alloc::string::String - Identity of the agent this token was issued to.
• session_id: ::prost::alloc::string::String - Session within which this token is valid.
• action_set: ::prost::alloc::vec::Vec<::prost::alloc::string::String> - Set of actions this token authorizes (e.g., [“http_get”, “db_read”]).
• resource_scope: ::prost::alloc::string::String - Resource scope this token covers (e.g., “api.example.com/*”).
• issued_at: ::core::option::Option<::prost_types::Timestamp> - When this token was issued.
• expiry: ::core::option::Option<::prost_types::Timestamp> - When this token expires. After expiry, the agent must call
• context_hash: ::prost::alloc::string::String - Integrity hash of the Cedar context used at issuance.
• signature: ::prost::alloc::vec::Vec<u8> - The raw signed token bytes.
• format: i32 - Token encoding format.
• policy_bundle_version: ::core::option::Option<::prost::alloc::string::String> - Policy bundle version at issuance time. Used for audit reconstruction.
• approver_id: ::core::option::Option<::prost::alloc::string::String> - operator_id of the human who approved this capability, set only when the
• approval_id: ::core::option::Option<::prost::alloc::string::String> - Approval record id bound to this capability, set only when the HITL path

Methods:

• fn format(self: &Self) -> TokenFormat - Returns the enum value of format, or the default if the field is set to an invalid enum value.
• fn set_format(self: & mut Self, value: TokenFormat) - Sets format to the provided enum value.
• fn policy_bundle_version(self: &Self) -> &str - Returns the value of policy_bundle_version, or the default value if policy_bundle_version is unset.
• fn approver_id(self: &Self) -> &str - Returns the value of approver_id, or the default value if approver_id is unset.
• fn approval_id(self: &Self) -> &str - Returns the value of approval_id, or the default value if approval_id is unset.

Traits: Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> CapabilityToken
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &CapabilityToken) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)

firma_protobuf::v1::ConnectorResponse

Struct

ConnectorResponse wraps the response from an external system after the Connector translates and forwards the ExecutionEnvelope.

Connectors apply technical constraints only (rate limits, schema validation, protocol translation). Business logic and authorization must remain in Cedar / Authority / Sidecar. A connector that becomes a second policy engine breaks auditability and system guarantees.

Fields:

• status_code: i32
• body: ::prost::alloc::vec::Vec<u8>
• headers: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>
• latency_micros: i64
• response_size_bytes: i64

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> ConnectorResponse
• PartialEq
  • fn eq(self: &Self, other: &ConnectorResponse) -> bool

firma_protobuf::v1::DbQueryParams

Struct

DbQueryParams carries parameters for a database query action.

Fields:

• query_name: ::prost::alloc::string::String - Named query identifier — no raw SQL allowed.
• bindings: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Bound parameters — scalar values only, keyed by placeholder name.
• db_name: ::prost::alloc::string::String - Target database name.
• read_only: bool - Hint for policy: is this a read-only query?

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &DbQueryParams) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> DbQueryParams

firma_protobuf::v1::DeniedApproval

Struct

DeniedApproval: an operator denied the request. Terminal; no token exists.

Traits: Eq, Copy

Trait Implementations:

• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &DeniedApproval) -> bool
• Clone
  • fn clone(self: &Self) -> DeniedApproval
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::EnforcementDecision

Enum

EnforcementDecision is the outcome of Sidecar evaluation. Conforms to AARM R4 (https://aarm.dev/spec): ALLOW/DENY/ABORT/MODIFY/STEP_UP/DEFER. A 0 (UNSPECIFIED) value is reserved and must never be emitted by the Sidecar; receivers should treat it as a protocol error.

Variants:

• Unspecified
• Allow - ALLOW — envelope forwarded to Connector.
• Deny - DENY — call blocked, structured response returned to agent.
• Abort - ABORT — mid-flight kill sent to agent and Connector.
• Modify - MODIFY — envelope forwarded to Connector with a modification applied
• StepUp - STEP_UP — call blocked pending stronger authentication. The agent must
• Defer - DEFER — call blocked pending asynchronous approval (human-in-the-loop).

Methods:

• fn is_valid(value: i32) -> bool - Returns true if value is a variant of EnforcementDecision.
• fn from_i32(value: i32) -> ::core::option::Option<EnforcementDecision> - Converts an i32 to a EnforcementDecision, or None if value is not a valid variant.
• fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
• fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.

Traits: Copy, Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &EnforcementDecision) -> bool
• Ord
  • fn cmp(self: &Self, other: &EnforcementDecision) -> $crate::cmp::Ordering
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• TryFrom
  • fn try_from(value: i32) -> ::core::result::Result<EnforcementDecision, ::prost::UnknownEnumValue>
• Clone
  • fn clone(self: &Self) -> EnforcementDecision
• Default
  • fn default() -> EnforcementDecision
• PartialOrd
  • fn partial_cmp(self: &Self, other: &EnforcementDecision) -> $crate::option::Option<$crate::cmp::Ordering>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_protobuf::v1::ExecutionEnvelope

Struct

ExecutionEnvelope is the core protocol unit of the Firma system.

Every outbound call from an agent is represented as a distinct ExecutionEnvelope, evaluated independently by the Sidecar. Each request is evaluated, enforced, and audited as an ExecutionEnvelope.

Treated as immutable once created — any enrichment (e.g., credential injection) produces a derived structure, not a mutation.

Fields:

• intent: ::core::option::Option<ExecutionIntent> - The action the agent intends to perform.
• capability: ::prost::alloc::string::String - Capability token string (PASETO v4 or JWT RS256) as issued by the Authority.
• metadata: ::core::option::Option<ExecutionMetadata> - Session and runtime metadata.
• provenance: ::core::option::Option<::prost::alloc::string::String> - Provenance: reserved, nullable field.

Methods:

• fn provenance(self: &Self) -> &str - Returns the value of provenance, or the default value if provenance is unset.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> ExecutionEnvelope
• PartialEq
  • fn eq(self: &Self, other: &ExecutionEnvelope) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self

firma_protobuf::v1::ExecutionEvent

Struct

ExecutionEvent is the immutable audit record for a single enforcement decision. Every field before signature is covered by the ECDSA signature, making the event independently verifiable.

Fields:

• event_id: ::prost::alloc::string::String - Unique event identifier (UUID v7 — time-ordered).
• session_id: ::prost::alloc::string::String - Session that produced this event.
• token_id: ::prost::alloc::string::String - Capability token ID evaluated during enforcement.
• agent_id: ::prost::alloc::string::String - Agent that initiated the action.
• action: ::prost::alloc::string::String - Canonical action class from the normalizer (e.g., “http_get”).
• resource: ::prost::alloc::string::String - Target resource identifier (e.g., URL, table name).
• decision: i32 - Enforcement outcome.
• deny_reason: ::prost::alloc::string::String - Human-readable reason when decision is DENY or ABORT. Empty on ALLOW.
• enforcement_latency_us: i64 - Wall-clock time spent in the enforcement pipeline, in microseconds.
• context_hash: ::prost::alloc::string::String - Integrity hash of the Cedar context used during evaluation.
• bundle_version: ::prost::alloc::string::String - Policy bundle version active at decision time.
• timestamp: ::core::option::Option<::prost_types::Timestamp> - Event timestamp with nanosecond precision.
• signature: ::prost::alloc::vec::Vec<u8> - ECDSA signature (DER-encoded) over all preceding fields.
• dispatch_status: i32 - HTTP status code returned by the connector. Zero when the call
• dispatch_latency_us: i64 - Wall-clock time spent in the connector dispatch, in microseconds.
• response_size: i64 - Target response body size in bytes. Zero when the call never
• sandbox_id: ::prost::alloc::string::String - Per-run identity that scopes this event to a single firma run
• provenance: ::prost::alloc::string::String - Tamper-evident provenance chain anchor (AARM R2 G2) for admitted
• thread_id: ::prost::alloc::string::String - Server-derived conversation thread identity (AARM R2 G2) for admitted
• parent_action_id: ::prost::alloc::string::String - Server-derived parent action identity (AARM R2 G2): the provenance

Methods:

• fn decision(self: &Self) -> EnforcementDecision - Returns the enum value of decision, or the default if the field is set to an invalid enum value.
• fn set_decision(self: & mut Self, value: EnforcementDecision) - Sets decision to the provided enum value.

Traits: Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> ExecutionEvent
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &ExecutionEvent) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)

firma_protobuf::v1::ExecutionIntent

Struct

ExecutionIntent describes the action the agent wants to perform. The oneof params field enforces that exactly one action kind is present, with schema validation at the proto level — no arbitrary key-value blobs.

Fields action_class, raw_transport, and raw_action_ref mirror the core ExecutionIntent struct and FEP §2.1: Stage 2 policy rules bind to action_class and resource (FEP [I-N1]); raw_transport and raw_action_ref are observational only and must not drive policy decisions.

Fields:

• resource: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Target resource attribute map. Conventional keys: “host”, “path”,
• action_class: ::prost::alloc::string::String - Canonical action class from the v0.1 registry (e.g.,
• raw_transport: ::prost::alloc::string::String - Original transport protocol (e.g., “http”, “https”, “grpc”, “exec”).
• raw_action_ref: ::prost::alloc::string::String - Original request signature for traceability (e.g.,
• params: ::core::option::Option<execution_intent::Params> - Typed action parameters — only one action kind is valid per intent.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> ExecutionIntent
• PartialEq
  • fn eq(self: &Self, other: &ExecutionIntent) -> bool

firma_protobuf::v1::ExecutionMetadata

Struct

ExecutionMetadata carries session and runtime context for an execution.

Fields:

• session_id: ::prost::alloc::string::String
• agent_id: ::prost::alloc::string::String
• timestamp: ::core::option::Option<::prost_types::Timestamp>
• trace_id: ::core::option::Option<::prost::alloc::string::String>
• risk_score: ::core::option::Option<f64> - Static or pre-computed risk attribute. V1 does not compute risk dynamically;
• thread_id: ::core::option::Option<::prost::alloc::string::String> - Server-derived conversation thread identity (AARM R2 G2). Groups
• parent_action_id: ::core::option::Option<::prost::alloc::string::String> - Server-derived parent action identity (AARM R2 G2). The provenance

Methods:

• fn trace_id(self: &Self) -> &str - Returns the value of trace_id, or the default value if trace_id is unset.
• fn risk_score(self: &Self) -> f64 - Returns the value of risk_score, or the default value if risk_score is unset.
• fn thread_id(self: &Self) -> &str - Returns the value of thread_id, or the default value if thread_id is unset.
• fn parent_action_id(self: &Self) -> &str - Returns the value of parent_action_id, or the default value if parent_action_id is unset.

Trait Implementations:

• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> ExecutionMetadata
• PartialEq
  • fn eq(self: &Self, other: &ExecutionMetadata) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::ExpiredApproval

Struct

ExpiredApproval: the request expired before a decision. Terminal; no token exists.

Traits: Copy, Eq

Trait Implementations:

• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &ExpiredApproval) -> bool
• Clone
  • fn clone(self: &Self) -> ExpiredApproval
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::GetApprovalOutcomeRequest

Struct

GetApprovalOutcomeRequest polls the outcome of one pending approval.

Fields:

• credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar. Workspace, sidecar,
• approval_id: ::prost::alloc::string::String - Approval record id returned by IssueCapability.
• session_id: ::prost::alloc::string::String - Session that opened the approval; must match the persisted request.

Traits: Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> GetApprovalOutcomeRequest
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &GetApprovalOutcomeRequest) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)

firma_protobuf::v1::GetApprovalOutcomeResponse

Struct

GetApprovalOutcomeResponse carries exactly one pending or terminal outcome.

Fields:

• outcome: ::core::option::Option<get_approval_outcome_response::Outcome>

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> GetApprovalOutcomeResponse
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &GetApprovalOutcomeResponse) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::GrantedApproval

Struct

GrantedApproval: an operator approved the request and the Authority issued the capability. Retrieval is repeatable: a retry after a lost response returns the same capability.

Fields:

• token: ::core::option::Option<CapabilityToken> - The signed capability token issued from the approved perimeter.

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> GrantedApproval
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &GrantedApproval) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::HttpParams

Struct

HttpParams carries parameters for an HTTP action.

Fields:

• method: ::prost::alloc::string::String - HTTP method (GET, POST, PUT, DELETE, PATCH).
• headers: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Request headers — allowlisted keys only.
• body: ::prost::alloc::vec::Vec<u8> - Request body as raw bytes (empty for GET/DELETE).
• query: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Query parameters.

Trait Implementations:

• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> HttpParams
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &HttpParams) -> bool

firma_protobuf::v1::IssueCapabilityRequest

Struct

IssueCapabilityRequest carries the agent’s identity and requested scope for capability issuance.

Fields:

• agent_id: ::prost::alloc::string::String - Identity of the requesting agent.
• requested_actions: ::prost::alloc::vec::Vec<::prost::alloc::string::String> - Actions the agent is requesting authorization for.
• resource_scope: ::prost::alloc::string::String - Resource scope the agent needs access to.
• session_id: ::prost::alloc::string::String - Session identifier for correlation.
• requested_ttl_seconds: i32 - Requested TTL in seconds for the capability token.
• credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar.
• issuance_attempt_id: ::core::option::Option<::prost::alloc::string::String> - Client-chosen idempotency key for this issuance attempt, unique per

Methods:

• fn issuance_attempt_id(self: &Self) -> &str - Returns the value of issuance_attempt_id, or the default value if issuance_attempt_id is unset.

Traits: Eq

Trait Implementations:

• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> IssueCapabilityRequest
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &IssueCapabilityRequest) -> bool

firma_protobuf::v1::IssueCapabilityResponse

Struct

IssueCapabilityResponse returns the outcome of an issuance evaluation: a signed capability token, a structured denial, or a pending-approval handle.

decision is the authoritative outcome. Every other field is populated per decision as shown below; consumers MUST switch on decision and ignore any field not listed for that decision. A well-formed response never populates a field outside its decision’s row (e.g. granted == true with DENY, or a token with PENDING_APPROVAL, are both invalid and must not be produced).

decision	populated fields
ALLOW	token (granted == true)
DENY	deny_reason, deny_message (granted == false)
PENDING_APPROVAL	approval_id, approval_url, approval_expiry
(granted == false)

granted is exactly (decision == ALLOW) and is retained only for 0.1.x clients that predate decision.

Fields:

• granted: bool - True iff decision == ALLOW. Retained for backward compatibility with
• token: ::core::option::Option<CapabilityToken> - The signed capability token. Set only when decision == ALLOW.
• deny_reason: ::prost::alloc::string::String - Structured reason code (e.g., “POLICY_DENIED”, “SCOPE_EXCEEDED”). Set only
• deny_message: ::prost::alloc::string::String - Human-readable denial message for debugging. Set only when decision == DENY.
• decision: i32 - Authoritative tri-state outcome of the evaluation. Consumers switch on
• approval_id: ::core::option::Option<::prost::alloc::string::String> - Approval record id. Set only when decision == PENDING_APPROVAL. optional so
• approval_url: ::core::option::Option<::prost::alloc::string::String> - URL the operator follows to approve/deny. Set only when
• approval_expiry: ::core::option::Option<::prost_types::Timestamp> - When the pending approval expires. Set only when

Methods:

• fn decision(self: &Self) -> IssueDecision - Returns the enum value of decision, or the default if the field is set to an invalid enum value.
• fn set_decision(self: & mut Self, value: IssueDecision) - Sets decision to the provided enum value.
• fn approval_id(self: &Self) -> &str - Returns the value of approval_id, or the default value if approval_id is unset.
• fn approval_url(self: &Self) -> &str - Returns the value of approval_url, or the default value if approval_url is unset.

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> IssueCapabilityResponse
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &IssueCapabilityResponse) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::IssueDecision

Enum

IssueDecision is the tri-state outcome of an IssueCapability evaluation.

Variants:

• Unspecified
• Allow - Capability granted: a signed token is returned.
• Deny - Denied by policy: a structured reason is returned, no token.
• PendingApproval - Issuance gated on human approval: an approval handle is returned, no token.

Methods:

• fn is_valid(value: i32) -> bool - Returns true if value is a variant of IssueDecision.
• fn from_i32(value: i32) -> ::core::option::Option<IssueDecision> - Converts an i32 to a IssueDecision, or None if value is not a valid variant.
• fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
• fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.

Traits: Eq, Copy

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> IssueDecision
• Default
  • fn default() -> IssueDecision
• PartialOrd
  • fn partial_cmp(self: &Self, other: &IssueDecision) -> $crate::option::Option<$crate::cmp::Ordering>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &IssueDecision) -> bool
• Ord
  • fn cmp(self: &Self, other: &IssueDecision) -> $crate::cmp::Ordering
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• TryFrom
  • fn try_from(value: i32) -> ::core::result::Result<IssueDecision, ::prost::UnknownEnumValue>

firma_protobuf::v1::PendingApproval

Struct

PendingApproval: no decision yet; poll again.

Fields:

• expires_at: ::core::option::Option<::prost_types::Timestamp> - When the pending approval expires; polling past this deadline is useless.
• retry_after: ::core::option::Option<::prost_types::Duration> - Server-suggested minimum delay before the next poll. Advisory: clients

Traits: Eq, Copy

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &PendingApproval) -> bool
• Clone
  • fn clone(self: &Self) -> PendingApproval
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)

firma_protobuf::v1::PolicyBundle

Struct

PolicyBundle is the set of Cedar policy files distributed from Authority to Sidecar. Stored as human-readable text; compiled into an in-memory policy set at load time. Treated as immutable during evaluation — Stage 2 evaluates against a stable snapshot.

Fields:

• version: ::prost::alloc::string::String - Bundle version identifier for debugging and audit correlation.
• policies: ::prost::alloc::vec::Vec<u8> - Serialized Cedar policy files.
• entity_schema: ::prost::alloc::vec::Vec<u8> - Serialized Cedar entity schema.
• ttl_seconds: u32 - Time-to-live in seconds. If TTL expires without refresh,

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> PolicyBundle
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &PolicyBundle) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::PolicyBundleUpdate

Struct

PolicyBundleUpdate wraps a policy bundle push from Authority to Sidecar.

Fields:

• bundle: ::core::option::Option<PolicyBundle> - The updated policy bundle.
• updated_at: ::core::option::Option<::prost_types::Timestamp> - Server timestamp of this update.

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> PolicyBundleUpdate
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &PolicyBundleUpdate) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::RevocationEvent

Struct

RevocationEvent signals the invalidation of a previously issued capability token. Propagated from Authority to Sidecar via streaming. Enforced locally in Stage 1 with no network calls at decision time.

Fields:

• token_id: ::prost::alloc::string::String - The token_id being revoked.
• reason: ::prost::alloc::string::String - Reason for revocation.
• timestamp: ::core::option::Option<::prost_types::Timestamp> - When the revocation was issued.

Traits: Eq

Trait Implementations:

• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> RevocationEvent
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &RevocationEvent) -> bool

firma_protobuf::v1::SidecarCredentials

Struct

SidecarCredentials are the credentials a Sidecar presents on every Authority request. The Authority resolves (workspace_id, sidecar_id) and verifies pre_shared_key against the stored hash.

Fields:

• workspace_id: ::prost::alloc::string::String - Workspace the Sidecar belongs to.
• sidecar_id: ::prost::alloc::string::String - Authority-assigned Sidecar identity.
• pre_shared_key: ::prost::alloc::string::String - The Sidecar’s pre-shared key, verified against the Authority’s stored hash.

Traits: Eq

Trait Implementations:

• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &SidecarCredentials) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> SidecarCredentials

firma_protobuf::v1::StreamEventsResponse

Struct

StreamEventsResponse is returned when the client half-closes the stream. It summarizes what the server received, allowing the client to verify delivery completeness.

Fields:

• last_event_id: ::prost::alloc::string::String - Event ID of the last event the server persisted.
• events_received: i64 - Total number of events received in this stream session.

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> StreamEventsResponse
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &StreamEventsResponse) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)

firma_protobuf::v1::TokenFormat

Enum

TokenFormat identifies the encoding format of a capability token.

Variants:

• Unspecified
• PasetoV4 - PASETO v4 — preferred format (Ed25519 or XChaCha20-Poly1305).
• JwtRs256 - JWT RS256 — fallback for environments with existing JWT infrastructure.

Methods:

• fn is_valid(value: i32) -> bool - Returns true if value is a variant of TokenFormat.
• fn from_i32(value: i32) -> ::core::option::Option<TokenFormat> - Converts an i32 to a TokenFormat, or None if value is not a valid variant.
• fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
• fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.

Traits: Copy, Eq

Trait Implementations:

• Ord
  • fn cmp(self: &Self, other: &TokenFormat) -> $crate::cmp::Ordering
• PartialEq
  • fn eq(self: &Self, other: &TokenFormat) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Default
  • fn default() -> TokenFormat
• PartialOrd
  • fn partial_cmp(self: &Self, other: &TokenFormat) -> $crate::option::Option<$crate::cmp::Ordering>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> TokenFormat
• TryFrom
  • fn try_from(value: i32) -> ::core::result::Result<TokenFormat, ::prost::UnknownEnumValue>

firma_protobuf::v1::ToolUseParams

Struct

ToolUseParams carries parameters for an agent tool invocation.

Fields:

• tool_name: ::prost::alloc::string::String - Registered tool name.
• input: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Tool input — scalar values only, schema validated against tool registry.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> ToolUseParams
• PartialEq
  • fn eq(self: &Self, other: &ToolUseParams) -> bool

firma_protobuf::v1::WatchPolicyBundleRequest

Struct

WatchPolicyBundleRequest initiates a policy bundle subscription.

Fields:

• current_version: ::prost::alloc::string::String - The sidecar’s current bundle version (empty string on first connect).
• credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar.

Traits: Eq

Trait Implementations:

• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> WatchPolicyBundleRequest
• Default
  • fn default() -> Self
• PartialEq
  • fn eq(self: &Self, other: &WatchPolicyBundleRequest) -> bool

firma_protobuf::v1::WatchRevocationsRequest

Struct

WatchRevocationsRequest initiates a revocation event subscription.

Fields:

• since: ::core::option::Option<::prost_types::Timestamp> - Timestamp of the last revocation event the sidecar received.
• credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar.

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &WatchRevocationsRequest) -> bool
• Hash
  • fn hash<__H>(self: &Self, state: & mut __H)
• Debug
  • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Message
  • fn encoded_len(self: &Self) -> usize
  • fn clear(self: & mut Self)
• Clone
  • fn clone(self: &Self) -> WatchRevocationsRequest
• Default
  • fn default() -> Self

Module: audit_service_client

Generated client implementations.

Module: audit_service_server

Generated server implementations.

Module: authority_service_client

Generated client implementations.

Module: authority_service_server

Generated server implementations.

Module: execution_intent

Nested message and enum types in ExecutionIntent.

Module: get_approval_outcome_response

Nested message and enum types in GetApprovalOutcomeResponse.