The brand-safety policy is data, so routing a piece to its list is a
membership check. route walks the policy tiers in order and returns
the first tier whose list contains the piece; anything unlisted
defaults to named_approver — when in doubt, a human signs.
Fill in the membership test.
Expected output:
ai_may_draft
banned_outright
named_approver