Governance evaluated after the fact cannot prevent the action it's meant to govern; the policy engine has to sit in the path of the request itself, the same reasoning DOM-002's own Tool-Call Policy Enforcement Agent (AGT-D02) was built on for a different domain's tool calls.
Escalated and ad-hoc requests only; RegistryMatch and MinorModified paths proceed without waiting on a person.
Allow a request tagged SensitiveIntentDetected to execute directly under any combination of other tags — that route is never optional, mirroring OP-G012/013's own hard routing rule.
Grounded Prompt Request; its data-sensitivity tags from Access Control & Data Protection; configured routing policy
A Policy Route Decision recording the outcome and the tags that produced it