ConstraintEnforcer

Module: enforcement::constraint_enforcement::ConstraintEnforcer

Contents

Functions

• evaluate - Evaluate the request against Cedar policies.

---

firma_sidecar::enforcement::constraint_enforcement::ConstraintEnforcer::evaluate

Function

Evaluate the request against Cedar policies.

Returns Ok(PolicyVerdict) for a passing or remediation outcome (Allow, Modify, StepUp, Defer), or Err(EnforcementDecision::Deny) if any check fails (scope, freshness, or a hard policy deny). The pipeline is responsible for lifting the verdict into a fully populated [EnforcementDecision].

Sequence:

1. Scope check — is action_class in the token’s action_set?
2. Check policy availability
3. Check policy bundle freshness
4. Build Cedar context
5. Evaluate Cedar policies (incl. AARM R4 remediation annotations)

Errors

Returns EnforcementDecision::Deny if scope check, bundle freshness, or Cedar policy evaluation fails, or if the policy denies the action.

fn evaluate(self: &Self, envelope: &NormalizedEnvelope, claims: &CapabilityClaims, signals: &RuntimeSignals) -> Result<PolicyVerdict, EnforcementDecision>