policy-check

A free agent skill that checks a proposed agent action against an operator-written mandate and returns permit, deny or escalate with the governing clause, then records the decision in a hash-chained local log. Runs locally, no network, no credentials. Advisory: it checks and records, it cannot enforce.