Module policy 

Policy engine — enforces access-control rules on session requests.

The coordinator evaluates all registered rules before creating a signing session. If any rule denies the request, the session is rejected with a typed PolicyDenial.

OCP design

New rules are added by implementing the Rule trait — no existing code is modified. The PolicyEngine collects rules and evaluates them in order.

Structs

MaxConcurrentSessionsRule

Limit concurrent sessions per quorum.

MaxThresholdRule

Enforce a maximum threshold.

MessageSizeRule

Enforce a maximum message size.

PolicyContext

Context provided to rules during evaluation.

PolicyEngine

Policy engine — evaluates a collection of rules.

TimeWindowRule

Allow signing only during the specified hour range (UTC).

Enums

PolicyDenial

Why a policy denied a request.

Traits

Rule

A single policy rule. Implementations decide whether to allow or deny a session request based on the request and context.