KemalIdentity::Authz::Decision

The result of an authorization check.

A union rather than a Bool, for the same reason Outcome is a union rather than a nilable principal: the granting role is reachable only in the branch where there is one, and adding a variant is a compile error at every exhaustive case ... in rather than a silently unhandled case. #permitted? is on both variants for the call sites that only want the yes or no.