Governance block

A governance block is a reusable policy rule applied to a DevAware OS loop. Blocks decide which tools the agent may invoke, what file scope is in bounds, and whether each flagged action triggers an approval prompt.

Governance blocks are composable: a project may stack a global block, a workspace block, and a per-turn block. The strictest setting wins.