Function authorize 

pub fn authorize(
    ruleset: &Ruleset,
    request: &Request,
    resource: Option<&Document>,
    documents: &dyn Documents,
    budget: &mut Budget,
) -> Decision

Decides one request against ruleset (the cloud.firestore service). resource is the stored document (None if it does not exist, or for a list). The rules’ version decides how recursive wildcards match.

The allow statements of every match that covers the path and names the method apply, in source order; one whose condition is true allows. A denial lists each one’s result: false for 'get' @ L5 or the error instead of false, with the line of the condition, or says No matching allow statements when none applies. For an upsert the statements of the other method are listed too, create’s first: each is false, or its condition’s error. Their lookups do not count against budget.

A list is decided from its query’s filter, not from the documents (list).