Module bot 

A bot’s grants: the rules its program needs, held to the room it was installed in, never reaching governance.

A program’s rules are written over any room, so one program can be installed anywhere. Installing scopes them to one room. The grant ids share one prefix per installation, so uninstalling revokes them all without a list.

Enums

BotRuleError

Why a program’s rules cannot become a bot’s grant.

Functions

bound

The bound a bot acts within. Its grants live in the room’s policy, so the bound carries none of its own: Bound::party finds them there.

fits_within

Whether new allows nothing old does not: every allowing grant of new sits at or below an allowing grant of old with at least its kinds. Such an update needs no fresh privileged review.

grant_prefix

The prefix every grant of installation carries.

grants

The grants installing installation in room gives, with installer (a user root, hex) as the grantor: the scoped rules, then the deny on the room resource that agent admissions carry too.

scoped_rules

rules held to room: each node’s room segment, named or any, becomes room.