OptionalallowAllowed tool globs over slash-separated words; a tool must match when the list is nonempty.
OptionaldenyDenied tool globs; a deny match takes precedence over allow.
Secret bearer token identifying this API key; never expose it in logs.
A named API key and what it may run: globs over tool words (see clyops-tools' ToolFilter).