Rule engine for agent tool calls: deny, rewrite, or attach context to a call before it r…