Module policy_intersection 

Host-owned delegation policy. A child receives a frozen subset of its parent’s authority, never a fresh resolution against the global universe.

uar.thread_policy is the versioned, restriction-only artifact extension for credential bindings and sandbox grants. Missing fields inherit; empty collections deny. Binding IDs refer to immutable host-resolved resources, not environment-variable names, filesystem paths, or credential lookups. The executor must use these exact bindings and reject an unenforceable sandbox policy before starting. This module performs no I/O or approvals.

Structs

CredentialGrant

A host-resolved credential (or explicitly credential-free service binding). The same target with a different binding is a different grant. Executors must not replace a binding with a child-agent/user/system/env fallback.

FilesystemGrant

Access to one immutable host filesystem binding, resolved before delegation. A binding includes the canonical host location and guest mount location; a child cannot redefine either by supplying a path under the same ID.

McpToolBinding

Trusted mapping from a runtime tool ID to its bound MCP server and upstream name. Never infer server identity by splitting an untrusted tool-name string.

SandboxPermissions

Concrete sandbox authority. No wildcard, path-prefix, or deny-rule grammar is accepted. Environment entries identify approved host bindings, not values.

ThreadBudgets

The existing extensions["budgets"] shape, decoded strictly at delegation. None is unbounded/inherited; zero is a real limit, never a default request. These are ceilings, not fresh balances: usage remains charged to the root.

ThreadPermissions

Additional root authority supplied by the trusted host, never spawn input. There is deliberately no deserializer or permissive default for this type.

ThreadPolicy

A host-held policy snapshot. Not deserializable, and no API can replace its root approval channel, grant approval, or insert child-supplied authority.

ThreadRateLimit

Root-shared rate ceilings; children do not receive independent rate buckets.

Enums

CredentialTarget

The service identity associated with a host-resolved credential binding.

PolicyIntersectionError

Fail-closed errors contain section names, never policy bodies or secrets.

ThreadToolBinding

Tool identity resolved by the host registry. Missing bindings are errors, not an implicit classification as a native tool.

Constants

THREAD_POLICY_EXTENSION

Artifact restrictions only; this extension cannot carry user authorization.