Guard the executor you actually own.

The SDK is the clearest integration when your application owns the function/tool registry and can remove or document bypass calls.

import { createRuleOak } from '@ruleoak/core'

const ruleoak = await createRuleOak({
  workspace: '.ruleoak',
  policy: { policyVersion: 2, defaultAction: 'deny', rules: [] }
})

const guarded = ruleoak.guardFunction({
  name: 'filesystem.read',
  category: 'file',
  operation: 'read',
  resource: ([path]) => path,
  execute: async (path) => path
})

Your application still owns

• business-domain validation;
• executor correctness;
• secrets and remote credentials;
• transport security;
• custom postcondition semantics;
• eliminating or documenting bypass paths.

Test the negative path first

A deny or approval-required decision must result in zero executor calls. Then test lease replay, policy/revocation change, response loss and custom effect verification.