为 AI 代理操作提供本地评估的失败即拒绝安全策略闸门。
Commerce preflights, Walmart mappings, D365 authorization, and offer checks; no external writes.
