Class DefaultComplianceEnvelope

java.lang.Object

ai.redouble.nucleo.harness.models.DefaultComplianceEnvelope

All Implemented Interfaces:

ComplianceEnvelope

public class DefaultComplianceEnvelope
extends Object
implements ComplianceEnvelope

The stock ComplianceEnvelope: the normal compliance decisions as declared state, refusing by default. A fresh instance permits everything except provider-data-share models, which is the framework's default posture when a servlet declares no envelope at all.

• setAllowDataShare(boolean) - opt-in for models that are served only under a data retention mode sharing prompts with the provider (ModelSpec.requiresLax()). Default false.
• setAllowedProviderKeys(Set) - when non-null, ONLY these provider keys may serve ("everything through our AWS account" is setAllowedProviderKeys(Set.of("anthropic-bedrock", "anthropic-bedrock-mantle", ...))).
• setDeniedProviderKeys(Set) - these provider keys never serve.
• setDeniedIdentities(Set) - these model identities never serve, regardless of endpoint.

Policies beyond these knobs are authored as their own ComplianceEnvelope implementations, not added here as flags.

Since:

0.1 (2026-08-28)

Author:

Andrey Santrosyan

Constructor Summary

Constructors

Constructor	Description
DefaultComplianceEnvelope()

Method Summary

Modifier and Type	Method	Description
Set<String>	getAllowedProviderKeys()
Set<String>	getDeniedIdentities()
Set<String>	getDeniedProviderKeys()
boolean	isAllowDataShare()
boolean	permits(ModelSpec spec)
void	setAllowDataShare(boolean allowDataShare)
void	setAllowedProviderKeys(Set<String> allowedProviderKeys)
void	setDeniedIdentities(Set<String> deniedIdentities)
void	setDeniedProviderKeys(Set<String> deniedProviderKeys)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DefaultComplianceEnvelope

public DefaultComplianceEnvelope()

Method Details

permits

public boolean permits(ModelSpec spec)

Specified by:

permits in interface ComplianceEnvelope

isAllowDataShare

public boolean isAllowDataShare()

setAllowDataShare

public void setAllowDataShare(boolean allowDataShare)

getAllowedProviderKeys

public Set<String> getAllowedProviderKeys()

setAllowedProviderKeys

public void setAllowedProviderKeys(Set<String> allowedProviderKeys)

getDeniedProviderKeys

public Set<String> getDeniedProviderKeys()

setDeniedProviderKeys

public void setDeniedProviderKeys(Set<String> deniedProviderKeys)

getDeniedIdentities

public Set<String> getDeniedIdentities()

setDeniedIdentities

public void setDeniedIdentities(Set<String> deniedIdentities)