Module sql_guard 

The SqlQueryGuard implementation.

The guard listens for ToolAction::DatabaseQuery { database, query } via chio_guards::extract_action and enforces four knobs defined by SqlGuardConfig: operation allowlist, table allowlist, per-table column allowlist, and regex predicate denylist. Failures route through SqlGuardDenyReason so downstream callers can match on structured reasons.

Fail-closed semantics:

• parse errors deny (even when allow_all is set);
• empty configurations deny unless allow_all is set;
• any check that fails short-circuits to Verdict::Deny;
• the guard passes non-DatabaseQuery actions through with Verdict::Allow (guards are additive).

Structs

SqlQueryGuard

Built-in SQL query guard (roadmap phase 7.1).