Function enforce 

pub fn enforce(
    root: &Path,
    action: &Action,
    target: &str,
) -> Result<(), JoyError>

One-shot guard check: resolve identity from session, check, enforce.