dogwood.policy

Python policy lifecycle objects modeled after dogwood_language.

The high-level SDK follows the Rust workflow:

ServiceSchema + PolicySchema -> ParsedPolicySet -> LoweredPolicySet -> Validator.

When a non-empty Cedar action schema is supplied, operations delegate to the native PyO3 binding and therefore to Rust dogwood_language. The pure-Python path is a temporary schema-less fallback for simple examples.

Classes

LoweredPolicySet(parsed, policy_schema[, ...])	Policy set lowered against Dogwood service and Cedar action schemas.
ParsedPolicy(id, effect, action[, when, ...])	Schema-free parsed policy summary.
ParsedPolicySet(source, service_schema, ...)	Dogwood policy source after schema-free parse.
PolicySchema(source)	Cedar action schema text used to lower Dogwood policies.
ServiceSchema([event_schema, macros, providers])	Dogwood service schema inputs.
ValidationResult([errors, warnings])	Validation findings for a lowered policy set.
Validator()	Validate a lowered Dogwood policy set.

class dogwood.policy.ServiceSchema(event_schema: str | None = None, macros: str | None = None, providers: dict[str, Any] | None = None)

Dogwood service schema inputs.

Rust mapping: dogwood_language::ServiceSchema. In Rust this is built with ServiceSchema::defaults() or ServiceSchema::builder() and can contain an event-schema DSL, provider declarations, and macro source.

In dogwood-py, event_schema is passed through to the native binding as ServiceSchema::builder().event_schema_str(...).build(). macros and providers are reserved for future binding support.

event_schema: str | None = None

macros: str | None = None

providers: dict[str, Any] | None = None

classmethod defaults() → ServiceSchema

Return the default Dogwood service schema.

Rust mapping: ServiceSchema::defaults().

__init__(event_schema: str | None = None, macros: str | None = None, providers: dict[str, Any] | None = None) → None

class dogwood.policy.PolicySchema(source: str)

Cedar action schema text used to lower Dogwood policies.

Rust mapping: dogwood_language::PolicySchema constructed with PolicySchema::from_cedarschema_str.

source: str

classmethod from_cedarschema_str(source: str) → PolicySchema

Create a policy schema from Cedar .cedarschema source.

Rust mapping: PolicySchema::from_cedarschema_str(source).

__init__(source: str) → None

class dogwood.policy.ParsedPolicy(id: str, effect: str, action: str | None, when: tuple[str, ...] = (), unless: tuple[str, ...] = (), temporal: tuple[str, ...] = (), index: int = 0)

Schema-free parsed policy summary.

Rust mapping: one policy inside dogwood_language::ParsedPolicySet. The Python fallback stores only a lightweight summary; native schema-backed parsing/lowering is handled by Rust.

id: str

effect: str

action: str | None

when: tuple[str, ...] = ()

unless: tuple[str, ...] = ()

temporal: tuple[str, ...] = ()

index: int = 0

uses_temporal() → bool

uses_providers() → bool

__init__(id: str, effect: str, action: str | None, when: tuple[str, ...] = (), unless: tuple[str, ...] = (), temporal: tuple[str, ...] = (), index: int = 0) → None

class dogwood.policy.ParsedPolicySet(source: str, service_schema: ServiceSchema, _policies: tuple[ParsedPolicy, ...])

Dogwood policy source after schema-free parse.

Rust mapping: dogwood_language::ParsedPolicySet. The Rust split is ParsedPolicySet::parse(source, &service_schema) followed later by ParsedPolicySet::lower(&policy_schema) when the Cedar action schema is available.

source: str

service_schema: ServiceSchema

classmethod parse(source: str, service_schema: ServiceSchema | None = None) → ParsedPolicySet

Parse policy source without a Cedar action schema.

Rust mapping: ParsedPolicySet::parse(source, &service_schema).

lower(policy_schema: PolicySchema) → LoweredPolicySet

Lower this parsed policy set against a Cedar action schema.

Rust mapping: ParsedPolicySet::lower(&policy_schema).

lower_with_distincter(policy_schema: PolicySchema, distincter: str) → LoweredPolicySet

Lower with a caller-supplied Cedar identifier namespace.

Rust mapping: ParsedPolicySet::lower_with_distincter. The current Python fallback uses distincter for generated fallback Cedar ids; native distincter support is not yet exposed through PyO3.

policy_count() → int

policies() → tuple[ParsedPolicy, ...]

__init__(source: str, service_schema: ServiceSchema, _policies: tuple[ParsedPolicy, ...]) → None

class dogwood.policy.ValidationResult(errors: tuple[str, ...] = (), warnings: tuple[str, ...] = ())

Validation findings for a lowered policy set.

Rust mapping: dogwood_language::ValidationResult. Errors make validation_passed false; warnings are reported separately.

errors: tuple[str, ...] = ()

warnings: tuple[str, ...] = ()

validation_passed() → bool

Return true when validation has no errors.

Rust mapping: ValidationResult::validation_passed().

__init__(errors: tuple[str, ...] = (), warnings: tuple[str, ...] = ()) → None

class dogwood.policy.Validator

Validate a lowered Dogwood policy set.

Rust mapping: dogwood_language::Validator. Unlike Cedar’s validator, Dogwood’s Rust Validator::new() takes no schema because the effective augmented schema travels on LoweredPolicySet.

validate(policies: LoweredPolicySet) → ValidationResult

Validate policies and return accumulated errors/warnings.

Rust mapping: Validator::new().validate(&policies).

class dogwood.policy.LoweredPolicySet(parsed: ParsedPolicySet, policy_schema: PolicySchema, distincter: str = 'policy')

Policy set lowered against Dogwood service and Cedar action schemas.

Rust mapping: dogwood_language::LoweredPolicySet. For schema-backed workflows, construction delegates to Rust LoweredPolicySet::from_str. The lowered set is schema-bound; validation and Cedar export use the same schemas it was lowered against.

parsed: ParsedPolicySet

policy_schema: PolicySchema

distincter: str = 'policy'

cedar_policies: str

source: str

classmethod from_str(source: str, service_schema: ServiceSchema | None = None, policy_schema: PolicySchema | None = None) → LoweredPolicySet

Parse and lower policy source in one step.

Rust mapping: LoweredPolicySet::from_str(source, &service_schema, &policy_schema). This is the fused parse/lower form.

as_cedar() → str

Return lowered Cedar policy text.

Rust mapping: LoweredPolicySet::as_cedar() rendered to text.

cedar_schema() → str

Return the augmented Cedar schema text.

Rust mapping: LoweredPolicySet::cedar_schema_str().

is_self_contained_cedar() → bool

Return whether exported Cedar is self-contained.

Rust mapping: LoweredPolicySet::is_self_contained_cedar(). Native support is not fully exposed yet; the Python fallback approximates this by checking whether parsed policies contain temporal clauses.

decide(event: Any, history: list[Any]) → Response

__init__(parsed: ParsedPolicySet, policy_schema: PolicySchema, distincter: str = 'policy') → None