Structural (always runs, no schema needed): every deny entry must be a
plausible name — non-empty, free of brackets/quotes/separators/whitespace.
Semantic (only when ColumnsFullyResolved is true): every deny entry
must actually match a column on some bound source. An entry matching nothing
is a no-op guard, which is the exact failure this module exists to prevent.
Validate a LeakageGuard configuration.
Two tiers of checking:
ColumnsFullyResolvedis true): every deny entry must actually match a column on some bound source. An entry matching nothing is a no-op guard, which is the exact failure this module exists to prevent.