Function required_scope_for_safety_class 

pub fn required_scope_for_safety_class(
    class: SafetyClass,
) -> Option<&'static str>

Minimum scope a caller must hold to execute a target of this class, regardless of the scope declared on the individual tool. The tool’s own declared scope is still enforced separately on top of this floor.

InProcessTrusted has no floor (None): static Rust compiled into this binary is trusted code whose manifest scopes govern entirely — this is what keeps public tools (e.g. help, which declares no scope) reachable by unauthenticated callers.