🔐 Requests are matched against deterministic static rules first (prefix, exact and glob URL patterns with optional HTTP method filters) — deny rules always take priority over allow
🤖 If no rule matches, an LLM judge evaluates the request against the agent's natural-language policy: allowed requests are forwarded, denied ones return a 403 with the reason