Evaluate a proposed action against an allowlist. Pure and deterministic.
Default-deny: returns inadmissible if rules is empty, if no rule's tool
matches, or if every matching rule rejects the args. When more than one rule
shares a tool name, the request is admissible if ANY of them admits it; the
reported reason is from the last rule tried.
Evaluate a proposed action against an allowlist. Pure and deterministic.
Default-deny: returns inadmissible if
rulesis empty, if no rule'stoolmatches, or if every matching rule rejects the args. When more than one rule shares a tool name, the request is admissible if ANY of them admits it; the reported reason is from the last rule tried.