f89ba94cb7
Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.
43 lines
1.0 KiB
Go
43 lines
1.0 KiB
Go
package clearance
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// EventStore persists clearance changes and audit rows.
|
|
type EventStore interface {
|
|
InsertClearanceEvent(agentID string, fromLevel, toLevel int, reason, source string) error
|
|
}
|
|
|
|
// RequestElevation raises an agent to toLevel when higher than current, logs the event, and returns the new level.
|
|
func RequestElevation(store EventStore, agentID string, currentLevel, toLevel int, reason, source string) (int, error) {
|
|
agentID = strings.TrimSpace(agentID)
|
|
if agentID == "" {
|
|
return currentLevel, fmt.Errorf("agent id required")
|
|
}
|
|
if toLevel < L0 {
|
|
toLevel = L0
|
|
}
|
|
if toLevel > L4 {
|
|
toLevel = L4
|
|
}
|
|
if toLevel <= currentLevel {
|
|
return currentLevel, nil
|
|
}
|
|
reason = strings.TrimSpace(reason)
|
|
if reason == "" {
|
|
reason = "elevation requested"
|
|
}
|
|
source = strings.TrimSpace(source)
|
|
if source == "" {
|
|
source = "system"
|
|
}
|
|
if store != nil {
|
|
if err := store.InsertClearanceEvent(agentID, currentLevel, toLevel, reason, source); err != nil {
|
|
return currentLevel, err
|
|
}
|
|
}
|
|
return toLevel, nil
|
|
}
|