Curious how strict the enforcement is in practice. We ran into this pretty quickly. The agent would follow the rules on paper but still do dumb things because the constraints were too coarse. Especially once you add multiple tools + retries. Did you end up needing per-tool policies, or is this more of a global guardrail layer?