package tyr
default allow = false
allow { input.service == "opax-mcp"; input.action == "read" }
allow { input.service == "ollama"; input.action == "infer"; input.model == "gemma3:4b" }