Function evaluate_command 

pub fn evaluate_command(
    rules: &RuleSet,
    tool: &str,
    raw_command: &str,
    default: Decision,
) -> Decision

Evaluate a (possibly compound) shell command against rules, folding every extracted sub-command’s decision down to the single strictest one (§5.3 risk 1’s compound-safety invariant). tool is the calling tool’s name ("bash", "shell", …) — sub-command patterns match as tool(cmdglob) against tool, e.g. a rule written "bash(rm -rf*)" applies to every sub-command of a bash call, not to a shell call.

default is the decision to use for a sub-command that parsed cleanly but matched NO rule in any tier — the caller supplies this (typically derived from ApprovalPolicy, see crate::agent’s gate) since “no rule says anything about this command” is a policy question, not something this engine decides on its own. default is never consulted for a sub-command the canonicalizer could not parse, or one it marked opaque — those always contribute at least Decision::Ask regardless of default (fail-closed: an ApprovalPolicy::Never-derived Allow default must NOT let an unparseable or opaque command slip through silently).