One door for every tool, with rules

1. 01Route every tool call through one function that knows who is calling, which tool and with what

   uv run pytest tests/test_gateway.py -q

   You pass when: A test passes showing that no tool can be reached without going through the gateway.

   Check step 1 gateway.pytests/test_gateway.py

2. 02Write three rules: support staff cannot pay, refunds over 100 need a person, everyone can look up a parcel

   Rules in a file can be read and signed off by someone who does not read code. Larger teams use a policy language such as Cedar for the same job.

   uv run pytest tests/test_policy.py -q

   You pass when: Tests pass for one allow, one deny and one needs-approval case.

   Check step 2 policy.yamltests/test_policy.py

3. 03Call a tool that no rule mentions

   uv run pytest tests/test_policy.py -q -k unknown

   You pass when: It is denied. Anything not allowed by a rule is refused.

   Check step 3 tests/test_policy.py

4. 04Record every decision with its reason

   tail -n 3 audit.jsonl

   You pass when: One line per call: who, tool, decision and the rule that decided it.

   Check step 4 audit.jsonl

The check runs on the computer, not on your word: a step passes when its command exits with 0 there.