Function is_agent_key_allowed 

pub fn is_agent_key_allowed(vault: &Vault, key: &str) -> bool

Whether key may be read under the agent allow-tag policy: always true when the vault has no policy, otherwise true only if the key carries an allowed tag. The public, per-key form of check_agent_keys, used by self-scope filtering (e.g. murk export).