function-hooksbsamiee/RasmRefuses tool calls by policy, and with observation on records hook events as database rows and delivers findings per lineage