Struct RiskProfileConfig 

pub struct RiskProfileConfig {

    pub level: AutonomyLevel,
    pub workspace_only: bool,
    pub allowed_commands: Vec<String>,
    pub forbidden_paths: Vec<String>,
    pub require_approval_for_medium_risk: bool,
    pub block_high_risk_commands: bool,
    pub shell_env_passthrough: Vec<String>,
    pub auto_approve: Vec<String>,
    pub always_ask: Vec<String>,
    pub allowed_roots: Vec<String>,
    pub delegation_policy: DelegationPolicy,
    pub approval_route: Option<ApprovalRoute>,
    pub allowed_tools: Vec<String>,
    pub excluded_tools: Vec<String>,
    pub sandbox_enabled: Option<bool>,
    pub sandbox_backend: Option<String>,
    pub firejail_args: Vec<String>,
}

Named risk/autonomy profile ([risk_profiles.<alias>]).

Unified policy surface. Agents reference a profile by alias and the runtime resolves through it for shell command allowlists, approval gates, sandbox/resource limits, and delegation guardrails. The conventional risk_profiles["default"] is the resolution target for non-agent contexts (orchestrator init, cron worker startup); the Default impl below mirrors the legacy safety-first defaults so a fresh install behaves the same as a config from before the per-profile split.

Fields

level: AutonomyLevel

Autonomy level applied to this profile. Default: supervised.

workspace_only: bool

Restrict filesystem access to workspace-relative paths. Default: false.

allowed_commands: Vec<String>

Allowlist of executable names for shell execution.

forbidden_paths: Vec<String>

Explicit path denylist.

require_approval_for_medium_risk: bool

Require approval for medium-risk operations.

block_high_risk_commands: bool

Block high-risk commands even when allowlisted.

shell_env_passthrough: Vec<String>

Environment variable names passed through to shell subprocesses.

auto_approve: Vec<String>

Tools that never require approval in this profile.

always_ask: Vec<String>

Tools that always require approval in this profile.

allowed_roots: Vec<String>

Extra directory roots the agent may access.

delegation_policy: DelegationPolicy

Whether agents using this profile may initiate delegation. Defaults to Forbidden. Reachable delegate targets and bounded/independent mode are resolved from each caller agent’s config.

approval_route: Option<ApprovalRoute>

Route this profile’s tool approvals to a DISTINCT approver channel instead of the channel that triggered the run (closes the cross-channel-HITL gap). Absent ⇒ the originating channel approves (today’s behavior). See crate::autonomy::ApprovalRoute.

Honored on both the interactive channel-driven path and the non-interactive turn path (gateway chat/webhook dispatch and agent-to-agent peer messages). On the non-interactive path the approver is resolved from the live daemon channel registry; if no registry is available or the approver is not live, the gate keeps the non-interactive default (fail-closed deny under the default on_no_approver).

allowed_tools: Vec<String>

Tools the agent may call in agentic mode. Empty = inherit / no authorization constraint. Authorization decision: which tools is the agent permitted to invoke at all. See excluded_tools for the inverse denylist scoped to non-CLI channels.

The TOML config does not distinguish an omitted field from allowed_tools = []; both deserialize to Vec::new() and SecurityPolicy::from_profiles maps that to “no authorization constraint” at this layer. If you need an explicit deny-all gate, apply it on the caller-supplied per-run allowed_tools (cron jobs and other narrowers pass that list in directly to ToolAccessPolicy, which honors Some(vec![]) as deny-all) or via excluded_tools covering the specific tools you want blocked.

MCP exception: when the list is non-empty, runtime-discovered MCP tools (any name containing __, which is the <server>__<tool> convention used by the MCP wrapper) are auto-admitted into the effective allow-list without needing to be listed here individually. This keeps the post-change eager-MCP default usable for agents with an explicit allow-list. Block individual MCP tools via excluded_tools.

Scope of the exception: the __ auto-admit applies only to this risk-profile allow-list, not to caller-supplied per-run allowed_tools (cron job allowed_tools, narrowed delegate invocations, etc.). Per-run lists are still strict explicit-list intersections, so a job that narrows allowed_tools = ["cron_add"] will not see runtime-discovered MCP tools unless it names them.

excluded_tools: Vec<String>

Tools excluded from non-CLI channels under this profile.

Also subtracts from the agentic-delegate allow-list resolved at runtime, which is the only way to block individual <server>__<tool> MCP names that would otherwise be auto-admitted by the allowed_tools MCP exception described above.

sandbox_enabled: Option<bool>

Whether the sandbox is enabled for this profile. None inherits global.

sandbox_backend: Option<String>

Sandbox backend identifier (e.g. "firejail", "landlock"). None inherits.

firejail_args: Vec<String>

Extra arguments forwarded to firejail when sandbox_backend = “firejail”.

Implementations

impl RiskProfileConfig

pub fn ensure_default_auto_approve(&mut self)

Merge the built-in default auto_approve entries into the current list, preserving any user-supplied additions.

pub fn sandbox_config(&self) -> SandboxConfig

Synthesize a SandboxConfig from this profile’s flattened sandbox fields. Sandbox config is stored flat on the profile; callsites that still want a SandboxConfig instance (sandbox detection in zeroclaw-runtime::security::detect) can call this helper.

impl RiskProfileConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<(), Error>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String, Error>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<(), Error>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

Trait Implementations

impl Clone for RiskProfileConfig

fn clone(&self) -> RiskProfileConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RiskProfileConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for RiskProfileConfig

fn default() -> RiskProfileConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RiskProfileConfig

where RiskProfileConfig: Default,

fn deserialize<__D>( __deserializer: __D, ) -> Result<RiskProfileConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for RiskProfileConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for RiskProfileConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &RiskProfileConfig)

impl Serialize for RiskProfileConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.