@adapter.guard(tool_name="deploy_service", action="deploy",
               environment="production", data_class="restricted")
def deploy_service(service: str) -> str: ...
# -> escalate: write action in prod on restricted data requires approval