Function record_scope_refusal 

fn record_scope_refusal(state: &AppState, did: &str, missing: &ScopeMissing)

The evaluation log’s row for a write outside its token’s scope, named auth::TOKEN_SCOPE_RULE where a tree’s row names a policy.