Struct Consumer 

pub struct Consumer {
    pub name: String,
    pub credentials: Vec<Credential>,
    pub policies: Vec<String>,
    pub consumer_type: ConsumerType,
    pub tool_allowlist: Vec<String>,
    pub token_budget: Option<TokenBudget>,
    pub priority: Option<u8>,
    pub groups: Vec<String>,
    pub authorization: Option<Authz>,
    pub quotas: Option<ConsumerQuotas>,
    pub ai_logging: Option<bool>,
    pub agent: Option<AgentPrincipal>,
}

Identity of an API caller (app/team/user); owns credentials, quotas, and the analytics identity.

Fields

name: String

credentials: Vec<Credential>

policies: Vec<String>

consumer_type: ConsumerType

The principal kind (DW-113): user (default) or agent. Agent consumers gain a tool allowlist, a per-agent token budget, and typed analytics attribution. The field is renamed to type in YAML (type is a Rust keyword).

tool_allowlist: Vec<String>

MCP tool allowlist (DW-113): when non-empty, the consumer may only call the named tools through the MCP gateway. Empty (the default) = no restriction. Validation checks that every name references a configured ai.mcp.tools entry.

token_budget: Option<TokenBudget>

Per-agent AI token budget (DW-113): when set, this consumer’s AI traffic is bounded by this budget BEFORE the policy chain (the most-specific budget). Same shape as a policy’s token_budget. None (the default) = no per-agent budget; the policy chain governs as before.

priority: Option<u8>

Consumer priority class for load shedding (DW-016): 0 (lowest) to 10 (highest). Stored and validated now; it takes effect only once authentication (DW-019/DW-020) identifies the consumer on a request — until then, shedding priority comes from the matched route (or the default 5). Consumer priority overrides the route’s when known, but it does NOT trigger reserved-bucket carving today — only a high-priority route does.

groups: Vec<String>

Consumer group memberships (DW-020): group names this consumer belongs to, consulted by authorization allowed_groups / denied_groups rules. Empty (the default) = no groups. Group names are free-form strings; validation checks that authorization rules referencing groups resolve against at least one consumer’s membership. Store-managed consumers carry their own groups in the state store (#124) — the group NAMESPACE is shared, but config-time validation can only see config consumers, so a rule referencing a group that exists solely on store consumers is flagged (grant at least one config consumer the same group name, or accept the issue is a false positive for store-only groups).

authorization: Option<Authz>

Consumer-level authorization rules (#123): the MOST specific link of the frozen chain consumer > route > service > listener > global — applies to every request authenticated as this consumer (naturally only once authentication has identified it). A deny at any level wins; otherwise the most specific level with rules governs (see Authz and the authz module). Same validation rules as route-level authorization.

quotas: Option<ConsumerQuotas>

Request budgets for this consumer (DW-033): a daily and/or monthly request cap counted in fixed UTC calendar windows (midnight-to-midnight UTC; the first through the last instant of the UTC month). Budgets are DISTINCT from rate limits: a rate limit shapes traffic inside seconds or minutes, a budget bounds total volume across a day or month, and the two mechanisms run independently (both apply when both are configured). Enforcement needs the state store (DWARA_STATE_DB) for durable counters — without one, quota config is inert (logged at request time, see the state::quotas module docs). Store-managed consumers have no config record, so budgets are config-consumer-only in this edition; a distributed shared-counter variant is the Ent follow-up (issue “DW-155”).

ai_logging: Option<bool>

AI prompt/response logging override (DW-081). None = inherit the global ai.logging.enabled setting; Some(false) = disable capture for this consumer even if global is on; Some(true) = enable capture for this consumer even if global is off (requires the ai.logging block to exist — the redactor and retention are always needed). The per-consumer toggle respects tenant preference: a consumer with capture disabled produces no stored prompts/responses.

agent: Option<AgentPrincipal>

AI-16 (#204): agent principal metadata. Only meaningful when consumer_type is agent; ignored otherwise. Carries the agent’s display name, description, owner, and permission level for first-class agent principal attribution.

Trait Implementations

impl Clone for Consumer

fn clone(&self) -> Consumer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Consumer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Consumer

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Consumer

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for Consumer

fn eq(&self, other: &Consumer) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Consumer

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Consumer