hermes - 💡(How to fix) Fix Enforce role identity and action policy for L

What to build

Add role-based identity and action policy enforcement to the L bridge. The bridge should distinguish owner, owner agent, partner agent, external person, and guest identities, then apply the auto, confirm, and forbidden action policy before responding or routing work.

Acceptance criteria

• The bridge can classify request actors into owner, owner_agent, partner_agent, external_person, or guest from configuration or authenticated metadata.
• The bridge enforces auto, confirm, and forbidden decisions before executing or proposing actions.
• Attempts to access leo_private or act on Leo's behalf require owner confirmation.
• Tests cover at least one allowed, one confirmation-required, and one forbidden action.

Blocked by

• #23838