A governance layer for Laravel MCP servers: scoped permissions, rate limiting, audit logging, and human approval for mutating tool calls.