Add one real domain overlay case

[fraware]

Add one narrow domain overlay with a paired allowed and blocked action.

State the evidence threshold, affected tools, policy rationale, and expected decision. Keep the case independent of live services.

[fraware]

Please comment with the domain, the two actions, and the evidence distinction you want the overlay to enforce. Keep the first case narrow.