Constant TOOL_DENIED_KEY 

pub const TOOL_DENIED_KEY: &str = "flow:tool_denied";

Written when the governed flow refuses a tool call: {"tool": name, "id": call id, "reason": why}.