Module enforcement 

Structs

ChainPolicy

Composes two policies in sequence. First denial wins.

RuleEvaluator

Enforces per-tool rules declared in nanny.toml under [tools.].

ToolPermissionPolicy

Enforces the tool allowlist declared under [tools] allowed.