rules.get, and again the class is the answer, not the text: a rule you thought was a hard gate might come back as guidance, with the reason it could not be compiled into one.
Unlike secrets, rules does carry an MCP tool. The worst an assistant can do with this surface is narrow its own permissions, the opposite risk a credential poses, so an assistant reading
rules.get can also tell a person “you think that is enforced and it is not”, which is the whole point of the split.