refactor: use NewLabeledResource constructor instead of inline struct literals

internal/guard/noop.go

@@ -35,13 +35,8 @@ func (g *NoopGuard) LabelAgent(ctx context.Context, policy interface{}, backend
 func (g *NoopGuard) LabelResource(ctx context.Context, toolName string, args interface{}, backend BackendCaller, caps *difc.Capabilities) (*difc.LabeledResource, difc.OperationType, error) {
 	logNoop.Printf("Labeling resource: tool=%s, operation=read-write (conservative)", toolName)
 
-	// Empty resource = no label requirements = all operations allowed
-	resource := &difc.LabeledResource{
-		Description: "noop resource (no restrictions)",
-		Secrecy:     *difc.NewSecrecyLabel(),
-		Integrity:   *difc.NewIntegrityLabel(),
-		Structure:   nil, // No fine-grained labeling
-	}
+	// Empty labels = no label requirements = all operations allowed
+	resource := difc.NewLabeledResource("noop resource (no restrictions)")
 
 	logNoop.Printf("Resource labeled with no restrictions: tool=%s", toolName)
 

internal/guard/write_sink.go

@@ -89,11 +89,8 @@ func (g *WriteSinkGuard) LabelResource(_ context.Context, toolName string, toolA
 	logWriteSink.Printf("LabelResource: tool=%s, operation=write, accept_tags=%d", toolName, len(g.acceptTags))
 	g.auditURLsInBody(toolName, toolArgs)
 
-	resource := &difc.LabeledResource{
-		Description: "write-sink (" + toolName + ")",
-		Secrecy:     *difc.NewSecrecyLabelWithTags(g.acceptTags),
-		Integrity:   *difc.NewIntegrityLabel(), // empty: no integrity requirements
-	}
+	resource := difc.NewLabeledResource("write-sink (" + toolName + ")")
+	resource.Secrecy = *difc.NewSecrecyLabelWithTags(g.acceptTags)
 
 	return resource, difc.OperationWrite, nil
 }