Function evaluate_authorization 

pub fn evaluate_authorization(
    db: &ObjectDatabase,
    request: AuthorizationRequest<'_>,
) -> Result<AuthorizationEvaluation, Error>

Evaluate the complete supplied local authorization context without locks, awaits, I/O, clock acquisition, or property writes (Clauses 12.31/12.35).

The request already represents an authenticated presentation. Every required criterion is evaluated in the explicit complete order, stopping at the first denial, pending dependency, or unresolved fact. The mode’s external phase follows successful criteria. NONE returns NoAuthorization, never Granted.

Original and companion validity use the same supplied wall time. Status and reasons are read once each and must agree with that time’s validity result; a changing object’s clock is not repaired or retried into a grant. This is consistent evidence at the supplied moment, not an atomic snapshot of an arbitrary application-owned ClockReader.

Assigned rights and accompaniment are computed internally under this shared database borrow. Only each relied-on companion’s exact authentication tuple and credential prerequisites are additionally checked; child transactions or recursive whole-controller authorization are not created.

PASSBACK exemption removes enforcement while preserving a known SOFT detection (Clauses 12.35.25/12.32.21). As this API’s evidence contract, missing or unusable optional reporting facts retain AuthorizationEvaluation::passback_reporting_problem without blocking an exempt check. This does not define a standard-wide unknown-evidence policy; unknown facts for required criteria still stop the pass.

Only AuthorizationOutcome::Granted permits access. Returned root intents are deterministic for fixed reads/evidence and contain at most four events, with terminal grant/denial last. The application owns publication, exactly-once handling, pending state, counters/history, and any physical action. Existing rights/accompaniment helpers retain their independent stage-only semantics.

Errors

An original identifier that does not name a local Access Credential or Access Point returns OBJECT / UNKNOWN_OBJECT. Missing/malformed/unsupported required evidence is retained in an Unresolved evaluation rather than a fabricated DENIED_OTHER. Request ordering and reason priority are validated at construction.