pub fn builtin_tool_labels() -> HashMap<String, ToolLabels>Expand description
Default information-flow labels for CAR’s built-in commodity tools.
Conservative and capability-only: the network-reaching tools are marked
as exfiltration sinks (so any confidential data flowing into them is
caught), and the file/process tools get capability tags so forbidden
orderings can be expressed against them. Nothing is marked confidential
by default — a project declares which of its tools/sources produce
sensitive data in .car/tool-labels.json.