feat: enforce request-level tool RBAC across router and execution gateway

Security objective

Ensure a request can expose and execute only tools authorized for its trusted caller, tenant, route, and policy context. Here RBAC means role-based access control; the implementation may use a richer attribute/policy model if required.

This requires two enforcement layers:

1. Router layer: remove denied tools from the request-side catalog before the model can select them.
2. Execution layer: re-authorize the emitted tool call immediately before execution in the gateway/orchestrator.

Response-side validation in the semantic router alone cannot guarantee pre-execution enforcement, especially for streaming protocols.

Audited upstream baseline (2026-07-15)

• The request ext_proc path can filter the offered tool catalog.
• The response path can observe emitted tool calls/traces, but the router is not the executor.
• Authorization-like routing signals and decisions live in configuration/classification/DSL/ext_proc surfaces.
• pkg/authz resolves upstream credentials; it is not the tool RBAC policy engine.
• Trusted caller identity and impersonation resistance are tracked in #2362.

Scope

1. Define a versioned tool authorization decision contract keyed by trusted principal/tenant, route, tool identity/version, and policy version.
2. Filter denied tools before model dispatch and record content-minimized decision reasons.
3. Define a signed or otherwise integrity-protected execution authorization context for the gateway/orchestrator.
4. Require the executor to re-evaluate current policy for the exact emitted tool call; define expiry, replay resistance, and time-of-check/time-of-use (TOCTOU) behavior.
5. Specify streaming behavior. If a protocol cannot guarantee authorization before execution, buffer at the execution boundary or declare the mode unsupported.
6. Record offered/denied/emitted/executed distinctions in a content-minimized RBAC audit projection. Existing Router Replay may retain bounded tool arguments/results when configured; do not imply that all Replay storage is content-free.
7. Add policy reload, revocation, audit, and fail-closed tests for privileged tools.

Boundaries

• Relevance ranking or Router Learning cannot override a denial.
• Tool results/arguments are not authorization inputs unless explicitly normalized by a trusted component.
• No caller-controlled header may mint privileged identity.
• This issue does not add a tool executor to the semantic router.
• Credential resolution in pkg/authz remains separate from RBAC policy.

Acceptance criteria

• Denied tools are absent from the model-visible request catalog.
• The execution gateway blocks calls without a valid current authorization decision.
• Policy version, trusted identity, expiry, replay protection, and revocation semantics are tested.
• Streaming cannot race authorization.
• Replay/audit data differentiates router filtering from executor enforcement.
• Metrics have bounded labels and do not expose tool arguments.
• E2E tests cover spoofed identity, stale authorization, policy reload, retries, and partial deployment.

Likely change surfaces

src/semantic-router/pkg/config/, src/semantic-router/pkg/classification/, src/semantic-router/pkg/extproc/, src/semantic-router/pkg/tools/, src/semantic-router/pkg/routerreplay/, gateway/orchestrator integration, docs, and E2E tests.

Depends on #2362. Related: #2357, #2361, #2545.

Validation entrypoint

make agent-report ENV=cpu CHANGED_FILES="<space-separated changed files>"

Follow the reported gates and affected E2E profiles.