Function rules_for_config 

pub fn rules_for_config(config: &Config) -> RuleSet

BP-5: the deny→ask→allow RuleSet a resolved crate::Config means, with the protected-path floor already folded into the deny tier.

ONE construction, so every surface that has to ask “is this allowed?” asks the same engine the same way: the agent’s tool-dispatch gate (Agent::permissions_gate_denial, which additionally narrows it with plan mode’s own deny rules) and the !`cmd` expansion in a skill/command body (crate::skills::ShellInjection). A second, hand-assembled rule set anywhere is a silent privilege split.