Enum EscalationViolation 

pub enum EscalationViolation {
    AutonomyAboveParent {
        child: AutonomyLevel,
        parent: AutonomyLevel,
    },
    ReadWriteRootNotInParent {
        path: PathBuf,
    },
    ReadOnlyRootNotInParent {
        path: PathBuf,
    },
    WriteOnlyRootNotInParent {
        path: PathBuf,
    },
    CommandNotInParent {
        command: String,
    },
    WorkspaceOnlyDisabledByChild,
    ForbiddenPathDroppedByChild {
        path: String,
    },
    ShellEnvPassthroughExpanded {
        variable: String,
    },
    MaxActionsExceeded {
        child: u32,
        parent: u32,
    },
    MaxCostExceeded {
        child: u32,
        parent: u32,
    },
    ShellTimeoutExceeded {
        child: u64,
        parent: u64,
    },
    BlockHighRiskCommandsDisabledByChild,
    RequireApprovalDisabledByChild,
}

Specific kind of escalation violation returned by SecurityPolicy::ensure_no_escalation_beyond. Each variant names the field that violated subset semantics so the SubAgent spawn path can produce a precise error to the caller.

Variants

AutonomyAboveParent

Child raises autonomy above the parent (e.g. parent Supervised, child Full). The autonomy level gates the entire can_act and approval flow, so silent escalation here would bypass every other guard.

Fields

child: AutonomyLevel

parent: AutonomyLevel

ReadWriteRootNotInParent

child.allowed_roots contains a path the parent cannot rw.

Fields

path: PathBuf

ReadOnlyRootNotInParent

child.allowed_roots_read_only contains a path the parent cannot read at all (not in parent rw or read-only lists).

Fields

path: PathBuf

WriteOnlyRootNotInParent

child.allowed_roots_write_only contains a path the parent cannot write at all (not in parent rw or write-only lists).

Fields

path: PathBuf

CommandNotInParent

child.allowed_commands contains a shell command the parent has no allowance for.

Fields

command: String

WorkspaceOnlyDisabledByChild

Parent enforces workspace_only but the child override tries to turn it off.

ForbiddenPathDroppedByChild

Child drops a forbidden_paths entry the parent enforces. Subset semantics on forbidden lists run the opposite direction from allowlists: parent ⊆ child, so the child can ADD entries but never DROP them.

Fields

path: String

ShellEnvPassthroughExpanded

Child raises shell_env_passthrough to leak env vars the parent declined to forward.

Fields

variable: String

MaxActionsExceeded

Child override raises max_actions_per_hour above the parent’s ceiling.

Fields

child: u32

parent: u32

MaxCostExceeded

Child override raises max_cost_per_day_cents above the parent’s ceiling.

Fields

child: u32

parent: u32

ShellTimeoutExceeded

Child override raises shell_timeout_secs above the parent’s ceiling. The shell budget is a runaway-process guard; raising it on the child side defeats the parent’s intent.

Fields

child: u64

parent: u64

BlockHighRiskCommandsDisabledByChild

Child flips block_high_risk_commands from true (parent) to false, opening the high-risk command surface the parent closed.

RequireApprovalDisabledByChild

Child flips require_approval_for_medium_risk from true (parent) to false, bypassing the human-in-the-loop step the parent required.

Trait Implementations

impl Clone for EscalationViolation

fn clone(&self) -> EscalationViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EscalationViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for EscalationViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for EscalationViolation

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for EscalationViolation

fn eq(&self, other: &EscalationViolation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for EscalationViolation

impl StructuralPartialEq for EscalationViolation