Function decide_function 

pub fn decide_function(
    policy: Option<&FunctionPolicy>,
    name: &str,
    registered: bool,
) -> FunctionDecision

The gate: built-ins always run; an unregistered name is not_found; then deny wins, then allow, then ask, then the policy’s default.