Policy Checks

Actions are validated against capability scopes and deterministic kill-switch rules.