Function authorize_write 

fn authorize_write<'a>(
    state: &AppState,
    writer: &'a Writer,
    writes: &[(&str, Action)],
) -> Result<Authorized<'a>, ApiError>

Checks a write against the scope of the token that presented it — see auth::Writer::authorize — and writes a refusal to the evaluation log beside the policy’s own, so what a token was refused reads in one place.

A collection that is not an NSID is refused first, as the store would refuse it, so a caller cannot write arbitrary strings into that log.