Putting the hard rules ahead of the mode check is the ordering we ended up with too, from a different direction. One of our guards never reads the tool arguments at all: the command that posts article announcements checks which environment it is running in and refuses on a local machine, because only the scheduled job is supposed to post those. No mode can switch it off, since it never asks for one. It covers the case where the command is fine and the caller is wrong, which a list of denied phrases can't see.