Permit and deny are both outcomes.

A currently authorized agent, a named effect inside policy, a request id, a receipt.

Missing authority, unknown effect, or malformed request. Nothing executes.