List access rules in a given layer, optionally filtered by lifecycle status.

Mirrors the real Management API show-access-rulebase shape: each rule carries a uid, name, source/destination/service object lists, action, and a lifecycle status (draft/published/installed) reflecting where it sits in the publish + install-policy workflow.

Add a new access rule to the current session.

The rule is created with status draft and is NOT committed or installed -- it lives in the current management session only. The orchestrator surfaces the draft to the operator for review, then calls checkpoint_publish_session and checkpoint_install_policy to move it through the lifecycle.

This is typically a human-gated step in a change workflow, reserved for network-policy changes.

Commit every drafted rule in the current session to the management server.

Drafted rules transition to published. Published rules survive across sessions but do NOT yet enforce on gateways -- that requires checkpoint_install_policy. Idempotent: calling with no drafts is a no-op.

Push published rules on a layer to the named gateways.

This is the moment a compensating-control rule actually starts blocking traffic on the wire. The orchestrator pairs this call with the operator's third human-in-loop approval.