Function allow_always 

pub fn allow_always(
    path: &Path,
    feature: Option<&str>,
    task: &str,
    call: &str,
    state: Option<&Path>,
    via: Via,
) -> CommandResult

AllowAlways: the waiting command call of task runs once and exactly its argv joins [commands] allow (or [sandbox] network_allow for a network call). Only for a call that offered it; a call still waiting is decided here, one answered Always Allow inline in this process was decided there.