DYOE Guardian — should an agent be allowed to take this action for its human? Automated trust + policy gate that returns approved / needs_human / denied (flags actions that need human sign-off). Input: ?action=&counterparty=&amount=