Guardrails

Global policy the engine reads through a dedicated hook before auto-posting. Defaults match the AP Exception Triage rules.