One policy. allows() returns true to permit the call, false to
deny it. name is used in audit logs and error messages.
allows may return a boolean synchronously or a Promise<boolean>
for policies that need an async lookup (group membership, zone
inheritance walk, etc.). The security gate detects the shape and
only takes the async branch when a Promise is returned; existing
sync policies continue to run sync through the gate.
One policy.
allows()returnstrueto permit the call,falseto deny it.nameis used in audit logs and error messages.allowsmay return abooleansynchronously or aPromise<boolean>for policies that need an async lookup (group membership, zone inheritance walk, etc.). The security gate detects the shape and only takes the async branch when a Promise is returned; existing sync policies continue to run sync through the gate.