Function confidence_ceiling_for 

pub fn confidence_ceiling_for(reason: UnknownReason) -> ConfidenceLevel

The strongest confidence a result may claim when its authorization hinges on reason. Runtime role/grant state and invoker-rights resolution are genuinely undecidable without a live session, so they cap at Low; anything else we treat as Opaque (we don’t even know enough to call it Low).