One global the program can call, and the functions hanging off it.
A binding is how a tool reaches model-authored code. functions maps the name
the program calls to the closure that serves it — already scoped to the caller,
because the closure is built from Nous.Permissions.filter_tools/2's output.
A denied tool still appears here, bound to a stub that returns an error, so the
program gets a comprehensible failure instead of an undefined-function crash.
error_class names the exception the substrate should raise inside the guest
when a call fails, so a program can try/catch in its own idiom.
There is exactly one permission mechanism. A binding is not a second one: it carries no allow/deny decisions of its own, only the closures that survived the policy.