Function default_exec_approval_requirement 

pub fn default_exec_approval_requirement(
    policy: AskForApproval,
    requires_sandbox_approval_prompt: bool,
) -> ExecApprovalRequirement

Compute the default approval requirement for a tool invocation.

requires_sandbox_approval_prompt should be true when the selected sandbox mode still requires an approval prompt, and false when the tool is already running unsandboxed or under an external sandbox that should not trigger an additional sandbox approval prompt.