Module scope 

Structs

StepToolScope

Per-step allow/deny tool scope. Enforcement is opt-in through SOP config.

Functions

resolve_excluded

Resolve the additional excluded tools for an active SOP step. This resolver is narrow-only: step scope can remove tools from the registry, never restore a tool already denied by the configured security policy.