Function is_primitive_allowed 

pub fn is_primitive_allowed(primitive: &str) -> bool

Check whether a named primitive is allowed under FIPS mode.

When FIPS mode is enabled (Enterprise), the primitive name is checked against the relevant allowlist (FIPS_ALLOWED_CIPHERS for cipher suite names, FIPS_ALLOWED_SIGNATURES for signature scheme names, FIPS_ALLOWED_CREDENTIAL_HASHES for credential hash format prefixes). Returns true when the primitive is on the allowlist or is not recognized as a restricted category (the check is conservative: an unknown primitive name is allowed, since the FIPS restriction targets specific known-non-approved primitives).

When FIPS mode is disabled (OSS), always returns true (no restriction).

The primitive argument is matched case-insensitively against the allowlist entries.