Function enforce_policy 

pub async fn enforce_policy(
    user: &PolicyUser,
    action: &str,
    resource: Option<&PolicyResource>,
) -> Result<(), StatusCode>

Enforce policy — returns Ok(()) if allowed, Err(StatusCode) if denied.