Two open-source Rust/WASM PDK policies for Flex/Omni Gateway that check what a per-call authorization can't: that an agent executes the exact call that was approved, and that individually authorized calls stay within a shared exposure budget across sessions.