Module bot 

A bot’s grants: the rules its program needs, held to the workspace it was installed in, never reaching governance.

A program’s rules are written over any workspace, so one program can be installed anywhere. Installing scopes them to one workspace. The grant ids share one prefix per installation, so uninstalling revokes them all without a list.

Enums

BotRuleError

Why a program’s rules cannot become a bot’s grant.

Functions

bound

The bound a bot acts within. Its grants live in the workspace’s policy, so the bound carries none of its own: Bound::party finds them there.

fits_within

Whether new allows nothing old does not: every allowing grant of new sits at or below an allowing grant of old with at least its kinds. Such an update needs no fresh privileged review.

grant_prefix

grants

The grants installing installation in workspace gives, with installer (a user root, hex) as the grantor: the scoped rules, then the deny on the workspace resource that agent admissions carry too.

scoped_rules

rules held to workspace: each node’s workspace segment, named or any, becomes workspace.