$ neti hook --demo --mode enforce -c neti.yaml -r h.ndjson
[exit 0]
{"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "Preflight blocked this call: /group resolves to 41,203 principals, above the declared ceiling of 200. Narrow the target and try again.", "neti": {"error": "preflight_ceiling_exceeded", "verdict": "block", "rule": "/group:magnitude>200", "decision_id": "<id>", "parameter": "/group", "unit": "principals", "resolved": 41203, "ceiling": 200, "session_total": 41203, "session_ceiling": 50}}}
