A deny composed into the user list must hold on the server itself: the runtime keeps its allow of the module's tools, and neither the tool's subject nor the caller-named subject process.Call sends on first reaches it. Builds: design 46 7 §6 (integration, the grants part's real-bus test) Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h