Module policy 

Tool policy helpers.

This module centralizes tool write-classification and permission-level decisions.

The pipeline, CLI, and GUI should rely on these helpers rather than duplicating their own logic for determining whether a tool call is:

• blocked (e.g. Sandbox write),
• requires confirmation (e.g. Restricted write), or
• allowed.

Structs

ToolConfirmationInfo

A user-facing description of a tool confirmation prompt.

ToolPolicyEvaluation

Evaluation of a tool call.

Enums

ToolCallDecision

Decision for a tool call at a given permission level.

Functions

evaluate_tool_call

Evaluate a tool call against a [PermissionLevel].

is_action_allowed

Return whether an action should be allowed for a session at the given permission level.

is_shell_command_write_operation

Conservatively determine whether a shell tool call is likely to perform a write.

is_write_operation

Determine if a tool operation is a write operation based on tool name and arguments.

requires_confirmation

Return whether an action should require confirmation for a session at the given permission level.