Function mcp_tool_access_policy 

pub fn mcp_tool_access_policy(
    security: &SecurityPolicy,
    caller_allowed: Option<&[String]>,
) -> Option<ToolAccessPolicy>

Build the MCP tool-access policy for an agent from its SecurityPolicy (allowed_tools + excluded_tools) and an optional caller-supplied allowlist. Shared by the runtime agent loop and the channels orchestrator so every MCP registration site gates through identical logic.