Function resolve_safe_keys 

pub fn resolve_safe_keys(
    config: &SafeCommands,
    agent: Option<&AgentSafeCommands>,
    blueprint: Option<&SafeCommandsConfig>,
    allow_blueprint_globally: bool,
) -> BTreeMap<String, SafeSource>

The safe keys in effect for one run, and where each came from.

Declaring is not granting. A blueprint’s own block contributes nothing unless allow_blueprint names this agent or [security] allow_blueprint_safe_commands is set, which is the same shape [read_paths] already uses: a manifest the user downloaded may describe what it would like to run unprompted, and the user decides whether that counts. This is also why resolve_policy needs no new argument and its “a blueprint may only tighten” tests keep their meaning.

An entry that is not a valid prefix is skipped with a warning rather than failing the spawn: a typo in a config file should cost one prompt, not a run.