Function classify 

pub fn classify(action: &str) -> Access

Classify an action.

Note two calls that may look surprising, both deliberate:

• exec is a write. Running a process can do anything the process can.
• egress is a write. Sending a request may change remote state, so two branches talking to the same host are not provably independent.

And use, as in secret:use:stripe_key, is a read: two branches using the same credential do not interfere with each other.