Proposal: Runtime behavioral trust as a Layer 3 authorization signal

## Context

OAP's Layer 3 evaluates whether a specific tool call is permitted. The current model uses declarative policies (capabilities, limits, scope).

There's a complementary runtime signal: **the behavioral reliability of the tool being called**. An agent may have permission to call a tool, but if that tool is currently exhibiting anomalous failure rates or degraded latency, the authorization decision could factor that in — either by adjusting risk scores or by requiring additional verification.

## Proposal

Add an optional `tool_trust` field to the Layer 3 evaluation context. Before executing a tool call, the OAP risk engine could query a behavioral trust endpoint that returns:

```json
{
"subject": "https://example.com/mcp",
"trust_score": 92.5,
"success_rate": 0.97,
"p95_latency_ms": 45,
"anomaly_status": "normal",
"freshness_ttl_seconds": 900
}
This enables policies like:

"deny if tool_trust.trust_score < 30" (block unreliable tools)
"require_human_approval if tool_trust.anomaly_status == 'critical'" (escalate on anomalies)
"allow if tool_trust.success_rate > 0.95" (fast-path reliable tools)
Fit with OAP
This aligns with the spec's existing risk engine concept ("real-time adjustments based on behavior"). The behavioral trust signal is consumed at evaluation time with sub-100ms latency, well within the 53ms median enforcement target when cached.

Prior Art
verascore-evidence-schema-v0.1 ([a2aproject/A2A#1786](https://github.com/a2aproject/A2A/issues/1786))
IETF draft-sharif-agent-payment-trust defines trust scoring for agent payment authorization
Lasso Security's MCP gateway already consumes reputation scores for allow/block decisions
Happy to elaborate or contribute to the integration guide.