Deny a connector call that addresses another workflow's state. The
caller's scope comes from WORKFLOW_SCOPE_CONTEXT_KEY (runtime-minted); the
target scope comes from the connector-specific extractor. Fail closed: a
call that targets workflow state without a minted caller scope is denied.
Register through ConnectorPolicies.evaluators.
Deny a connector call that addresses another workflow's state. The caller's scope comes from WORKFLOW_SCOPE_CONTEXT_KEY (runtime-minted); the target scope comes from the connector-specific extractor. Fail closed: a call that targets workflow state without a minted caller scope is denied. Register through ConnectorPolicies.evaluators.