feat: an OPA decision point for tool-call parameters

Cluster-scoped and platform-owned: every domain gateway asks the same server, so
a rule is written once rather than five times.

The policy has an opinion about arguments and none about anything else — the
handshake, the tool listing and the REST surface pass untouched. Two rules
today: a cap on how much one call may read, which is what a request-counting
rate limit cannot see, and a bound on a unit price, which is the parameter that
turns a permitted write into an expensive mistake.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

opa/policy.rego

@@ -0,0 +1,73 @@
+# Authorisation on tool-call *parameters*, not just the tool name.
+#
+# The estate already answers "may this identity call this tool?" — the MCP
+# server filters tool discovery by the caller's roles. What nothing answered is
+# "may it call it with *these* arguments". `write` authorises writing; it does
+# not authorise this particular record. A read cap counts calls; it does not
+# stop one call asking for ten thousand rows.
+#
+# This runs at the gateway, so it holds whether the caller is an agent behaving
+# itself, an agent that has been talked into something, or a person with curl.
+
+package kong
+
+import rego.v1
+
+default allow := false
+
+# Everything that is not an MCP tool call passes: the session handshake, the
+# tool listing, the REST surface. This policy has an opinion about arguments
+# and no opinion about anything else.
+allow if not is_tool_call
+
+allow if {
+	is_tool_call
+	count(violations) == 0
+}
+
+is_tool_call if {
+	input.request.http.parsed_body.method == "tools/call"
+}
+
+tool := input.request.http.parsed_body.params.name
+
+args := object.get(input.request.http.parsed_body.params, "arguments", {})
+
+# --- how much one call may read -------------------------------------------
+#
+# The rate limit counts requests. Without this, one request asking for a
+# hundred thousand rows costs the same as one asking for ten — which is how a
+# volume cap is defeated without breaking it.
+max_page_size := 200
+
+violations contains msg if {
+	size := to_number(object.get(args, "query_page_size", 0))
+	size > max_page_size
+	msg := sprintf("query_page_size %d exceeds the maximum of %d", [size, max_page_size])
+}
+
+# --- what one call may commit ---------------------------------------------
+#
+# A price is the parameter that turns a permitted write into an expensive
+# mistake. The bound is deliberately wide: this is not pricing policy, it is a
+# guard against a value that can only be an error or an attack.
+max_unit_price := 100000
+
+violations contains msg if {
+	body := object.get(args, "body", {})
+	some field in ["buyprice", "msrp"]
+	value := to_number(object.get(body, field, 0))
+	value > max_unit_price
+	msg := sprintf("%s %v exceeds the maximum of %d", [field, value, max_unit_price])
+}
+
+violations contains msg if {
+	body := object.get(args, "body", {})
+	some field in ["buyprice", "msrp"]
+	to_number(object.get(body, field, 1)) <= 0
+	msg := sprintf("%s must be greater than zero", [field])
+}
+
+# What the caller is told. A refusal that does not say which argument was
+# refused sends someone looking in the wrong place.
+reason := concat("; ", violations)