Function verdict_for 

pub fn verdict_for(
    requested: &ScopeSet,
    ceiling: &ScopeSet,
    rule: &str,
) -> Verdict

The verdict a ceiling alone gives for one request.

granted empty is a refusal, an empty cut is an unqualified yes, and anything else is a narrowing that names what it took. A policy refusal is applied by the caller on top of this, because a policy can only ever make the answer worse.