PolicyGate

Policy gate for tool authorization. Checks scopes, channel policies, and tool permissions. Supports dynamic rules via PolicyRuleProviderInterface (e.g. the host's Doctrine-backed provider). **Fail-closed on unknown channels.** A channel nobody registered no longer inherits the laxest possible policy (the old `?? []`, under which `require_auth` defaulted to false and an anonymous caller sailed through). An unregistered channel now falls back to {@see self::UNKNOWN_CHANNEL_POLICY} — `require_auth: true`, no `allow_all` — and the gate emits a learnable warning naming it. An unknown channel is treated as untrusted, never as the most permissive one.

public function __construct(Psr\Log\LoggerInterface $logger = new NullLogger()):

Parameters

public function setRuleProvider(Milpa\ToolRuntime\Contracts\PolicyRuleProviderInterface $provider): void

Set the policy rule provider for database-driven rules.

Parameters

public function getRuleProvider(): ?Milpa\ToolRuntime\Contracts\PolicyRuleProviderInterface

Get the current rule provider (if set).

public function channelPolicy(string $channel): array

La channel policy efectiva de un canal (lectura pura para la inspección, ADR#13) — delega en el mismo {@see policyFor()} que usa authorize()/requiresConfirmation(), así el plan renderea la MISMA política que el runtime consulta, con el mismo fail-closed para canales desconocidos.

Parameters

public function hasRuleProvider(): bool

¿Hay un provider de reglas DB conectado? Lectura pura para la inspección (ADR#13).

public function authorize(Milpa\ToolRuntime\Contracts\ToolContext $ctx, Milpa\ToolRuntime\ToolDefinition $tool, array $arguments = []): Milpa\ToolRuntime\Policy\AuthorizationResult

Authorize a tool call.

Parameters

public function authorizeScopes(Milpa\ToolRuntime\Contracts\ToolContext $ctx, string $name, array $scopes): Milpa\ToolRuntime\Policy\AuthorizationResult

Judge declared scope requirements before a surface asks for call-specific consent. This is the scope check used by authorize(), exposed so the CLI and the governed door ask the same question (greenhouse decisions/0314). Admission here does not grant consent or bypass channel/database policy. The full authorization must still run before execution.

Parameters

public function setCallPolicy(Milpa\ToolRuntime\Contracts\CallPolicy $policy): void

Install the host's restrictions; they can only narrow declared scope admission.

Parameters

public function getCallPolicy(): ?Milpa\ToolRuntime\Contracts\CallPolicy

The same host policy is available to a confined executor.

public function authorizeCall(Milpa\ToolRuntime\Contracts\ToolContext $ctx, Milpa\ToolRuntime\ToolDefinition $tool, array $arguments): Milpa\ToolRuntime\Policy\AuthorizationResult

Judge authority before consent; the full channel/database policy still runs at execution.

Parameters

public function requiresConfirmation(Milpa\ToolRuntime\Contracts\ToolContext $ctx, Milpa\ToolRuntime\ToolDefinition $tool): bool

Check if confirmation is required for this context + tool.

Parameters

public function setChannelPolicy(string $channel, array $policy): void

Set custom channel policy.

Parameters