pub fn normalize(set: &GrantSet) -> GrantSetExpand description
Remove every atom that another atom in the set already permits.
Only a definite containment removes an atom. Where the solver returns
Tri::Unknown both atoms are kept: dropping one on an undecided answer
would silently narrow the set, and quietly losing a permission is as much a
bug as quietly gaining one.
This is why templates survive alongside concrete atoms — fs:read:{path}
and fs:read:/src/** are undecidable against each other, so neither
absorbs the other.