As part of #277, we want to introduce the ability to `warn` in policies,
as well as `deny`.

This is a good prefactor, as it's a rather sizeable change, and requires
we:

- wire in the level to queries
- require that it's a single value, `ERROR`
- require that it is included in making a violation unique