Hard constraints define what is reachable. Nothing learned, semantic or statistical can widen that set — optimisation only ever chooses better inside it.
Policies compose across scopes: organisation, environment, project, pool, request. Allowlists intersect, denylists union, ceilings take the minimum and floors take the maximum. A narrower scope can only ever shrink what is permitted, so a request-level policy cannot escape an organisation-level one.
A tool class with no configured permission is refused, not allowed. An unconfigured trust boundary that defaults to permissive is not a boundary. The same rule applies to unknown constraint keys, which are rejected rather than silently dropped — a typo that disappears is a policy that appears applied and is not.
Discovered tools arrive unclassified and are exposed to nothing until an administrator says what they do. A server that could assert its own risk class would hand the decision to the least trustworthy party — a delete operation arrives indistinguishable from a read.
Spend caps apply at organisation and API-key level only. User, project and workspace scopes are specified but an execution records neither a user nor a project, so accepting them would produce caps that appear configured and are never enforced — worse than an absent feature.