Normalize Tool Names Before Policies Ever See Them

Frameworks name the same tool differently, and policies written against raw names silently fail to cover the aliases they never heard of.

A policy that denies file_write does nothing about write_file. Normalization is the unglamorous step that makes policy coverage mean what it says.

Normalization rules

• Adapters translate to canonical tool names at the boundary.
• Unknown names are denied and queued for classification, not passed through.
• The canonical vocabulary is versioned and reviewed like policy.

Use the adapter system, AuthGuardian, and integration guide to evaluate policy against canonical names, never raw aliases.