Function action_allowed 

pub fn action_allowed(caller: &CallerRole, action_name: &str) -> bool

Check whether caller is authorized to invoke action_name against the compile-time baseline (no operator overrides).

Returns true if the action is known and the caller’s role meets or exceeds the minimum role required by the per-action allowlist. Returns false for unknown actions (the caller should surface a validation error separately).

Production code paths should go through PolicyTable::action_allowed to honour [policy.risk_overrides]. This free function is kept for tests and call sites that genuinely need the baseline (e.g. validating that an override is a raise).