ModelNotAllowedError

Where the offending spec was declared (e.g. a subagent name and file path), prefixed to the message. Without it a rejection inside a loop over many declaration files names only the model, leaving the user to bisect by hand.

The spec that was rejected, as the user supplied it (so a bare model name is echoed back unqualified). Pass None when no specific model was requested -- an empty allowlist blocking default resolution -- so the message does not invent a spec the user never typed.

Human-readable label for the configuration layer that supplied the policy, as produced by the manifest resolver (e.g. 'config.toml'). MANAGED_CONFIG_SOURCE is compared literally to select administrator wording; None yields generic wording.