Policy Enforcement
Runtime policy evaluation before every action.
Every governed action runs through policy evaluation. Blocked actions return allowed: false. Workspace require_execution_proxy setting prevents bypass via evaluate-only paths for tool/resource actions.