Struct CoderPolicy 

pub struct CoderPolicy {
    pub chain: InspectorChain,
    pub credentialed_contract_chain: InspectorChain,
    pub denied_tools: BTreeSet<String>,
}

Build the standard coder chain plus every operator-authored policy that governs this session.

The source order deliberately matches car_policy::tool_gate: machine-wide rules first, then rules committed with the project. All current rule kinds are prohibitions, so merging cannot relax a built-in or an earlier rule. Built-ins remain ahead of the declarative inspector because first-Deny-wins decides which actionable reason the model sees.

Tool names stay exact. A policy for a surface-specific tool the coder does not expose (for example Claude Code’s WebFetch) is loaded but has nothing to match; CAR does not guess aliases between tools with different schemas. Stateful trace_rule is also deliberately excluded: the shared loader rejects it as unenforced instead of silently claiming it took effect. The chain, plus the tools the operator’s rules forbid outright.

Both come from one load of the policy files. The denied set is returned rather than left inside the chain because it answers a question dispatch cannot: which tools should never have been offered to the model in the first place. See car_policy::PolicyEngine::blanket_denied_tools.

Fields

chain: InspectorChain

credentialed_contract_chain: InspectorChain

denied_tools: BTreeSet<String>