Function decide 

pub fn decide(action: &Action, policy: &Policy) -> Verdict

Decide whether action is permitted under policy.

Pure and total: every action yields either Allow (with obligations) or Deny (with a reason). The default, when no rule matches, is Deny(NotAllowed).