constrainlisted

## Intent Execute **constrain** to evaluate proposed actions against defined policies, enforce permission boundaries, and reduce scope to the minimum required for safe operation. This is the gatekeeper that prevents unsafe actions before they execute. **Success criteria:** - All relevant policies evaluated for the proposed action - Clear allow/deny decision with rationale - Scope reduced to minimum necessary permissions - Violation actions documented (block, warn, log) **Compatible schemas:** - `schemas/output_schema.yaml` ## Inputs | Parameter | Required | Type | Description | |-----------|----------|------|-------------| | `action` | Yes | object | The proposed action to evaluate (capability, target, parameters) | | `policy_id` | No | string | Specific policy to evaluate against (default: all applicable) | | `scope` | No | object | Current permission scope to constrain | | `enforcement_level` | No | enum | strict (block), advisory (warn), audit (log only) | | `context` | No | object | Additional context for policy evaluation (user, session, etc.) | ## Procedure 1) **Identify applicable policies**: Find all policies relevant to the action - Load policy definitions from `.policies/` or policy registry - Match action type to policy triggers - Consider context (user role, environment, time) for policy selection 2) **Evaluate preconditions**: Check if action meets basic safety requirements - Is action within workspace boundaries? - Does action target sensi