output-pipe
A deny rule: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead.
What it catches
Magus output piped into a filter, when magus projects the record itself.
Why
magus projects its own record, so the filter is answering a question the command takes a flag for: -o name for ids, -o json for the whole record, -o template='{{.field}}' for one field, -s to silence progress. The half a reader cannot discover by trying again is the exit status: a pipe takes it from the LAST stage, so a failing magus reads as exit 0 and nothing says so.
Seeing it
A verdict names its rule in brackets, which is how you got here:
deny [output-pipe]: ...
magus describe rule output-pipe prints the same entry at a terminal, and
magus describe rules lists every rule this workspace enforces.