Function evaluate_subject 

pub fn evaluate_subject<'a>(
    pass: &'a VerifiedPass,
    resource: &AccessResource,
    action: AccessAction,
    now: u64,
) -> Result<Decision<'a>, Error>

Maps agent message/watch to the placed agent’s right. Every other act uses

its existing subject right. The adapter’s one evaluation site calls this; held rights keep the adapter’s existing hot-mode refusal, never approval.

Errors

The verified pass’s expiry, audience or rights error, unchanged.