What agents can do, what content/arguments get flagged, and who they resolve against — all one rule list, one engine.
A named set of agent ids. Use it as a rule's principal (e.g. "group:vendor-agents") instead of listing the same agents in every rule.
No agent groups yet.
A named set of tool ids. Use it as a rule's tool (e.g. "group:destructive-tools") instead of listing the same tools in every rule.
principal-tool and rate-ceiling rules — an agent's entire permission surface, top to bottom.
Evaluated before any content/argument rule; a matching block stops here.