Args:
    action_type: The action to check (e.g. "data:read:users", "api:external:call")
    agent_id: Optional agent ID to check policies for

Fail-open: a per-check exception is recorded as a warning, not a blocker.

Args:
    agent_id: The agent ID to check
    action_type: The action to check (e.g. "data:read", "api:call")

Args:
    agent_id: The agent performing the action
    action_type: Type of action (e.g. "data:read", "api:call")
    action_id: Unique identifier for this action
    payload: Optional JSON payload describing the action details
    compliance_mode: When True, mint a Compliance Receipt by sending the
        hash-only wire envelope (hash + hash_algo + payload_size). Requires
        payload to be supplied so the cloud can resolve the payload_digest
        object form.

Args:
    agent_id: The agent ID to look up

Args:
    signature_id: The signature ID to verify

Use to detect post-sign tampering of an agent's reported result.

Args:
    signature_id: The signature ID (from complete_action or sign_action)
    expected_output: The output string to verify against the signed hash

Both outcomes hit the audit trail. After an APPROVED gate, call
complete_action(gate_id, result) to bind the outcome into a bilateral receipt.

Args:
    action_type: The action to gate (e.g. "data:delete:users", "tool:execute:sql")
    agent_id: The agent requesting the action
    tool_name: Optional name of the tool being invoked
    arguments: Optional JSON string of the tool arguments
    risk_context: Optional description of why this action is risky

Produces a bilateral receipt: approval + outcome bound by gate_id. Required to close
the audit gap where approval is provable but result is not.

Args:
    gate_id: The gate_id returned by gate_action when it approved the action
    result: A description or JSON string of the action's outcome

With tool_endpoint set, the approved call is forwarded and request+response are signed
together as one bilateral receipt. Without it, an approval token is returned and the
agent must call complete_action(call_id, result) to close the receipt.

Args:
    tool_name: Name of the tool to execute
    agent_id: The agent requesting the tool call
    arguments: Optional JSON string of tool arguments
    tool_endpoint: Optional HTTP endpoint to forward the approved call to

Policies are evaluated in-process (no API hop). Setting tool_endpoint lets
enforced_tool_call forward the call and sign request+response as a bilateral receipt.

Args:
    tool_name: Name of the tool to create a policy for
    risk_level: Risk classification - "low", "medium", or "high"
    require_approval: If true, high-risk tools need human approval before execution
    max_calls_per_minute: Rate limit (0 = unlimited)
    blocked: If true, the tool is completely blocked
    hidden: If true, the tool is invisible - not listed and treated as nonexistent
    tool_endpoint: Optional HTTP endpoint to forward approved calls to

Args:
    tool_name: Name of the tool to remove the policy for

Checks for prompt injection, hidden unicode, dangerous schema fields,
typosquatting, and hardcoded secrets. Returns a risk assessment.

Args:
    tool_name: The tool name to scan
    description: The tool description to scan
    input_schema: Optional JSON string of the tool's input schema