Function evaluate_path_subject_safe_roots 

pub fn evaluate_path_subject_safe_roots(
    rules: &RuleSet,
    tool: &str,
    roots: &[PathBuf],
    raw_path: &str,
    default: Decision,
) -> Decision

BP-10: evaluate_path_subject_safe over every granted root — see evaluate_path_safe_roots’s doc comment for the fold’s rationale.