Function decide 

pub fn decide(
    required: CapabilitySet,
    granted: CapabilitySet,
    policy: &CallPolicy,
    tool_name: &str,
) -> GateOutcome

The one pure decision: compare what the call requires with what it is granted, under the argument-aware policy verdicts, and return the single GateOutcome.

Precedence, pinned by test:

1. hard policy veto ⇒ GateOutcome::Deny;
2. required ⊄ granted ⇒ GateOutcome::Escalate carrying the missing set and a plain-language reason;
3. the policy demands a human (argument-aware gate or sandbox-denial escalation) ⇒ GateOutcome::Escalate with an empty missing set;
4. otherwise honor the argument transform or allow.

The engine is pure set algebra over the capability sets — it never matches on a specific Capability, so extending the taxonomy requires no change here (pinned by test).