Ask HN: Using OPA/Rego to secure MCP tool execution. Does it make sense?