SE1 ★ — deny-precedence. Two rules on entity:read, same priority, one Allow + one Deny → Deny
wins (ScopeEvaluator sorts IsDeny DESC at equal priority, so the deny rule is evaluated first and
short-circuits). A control key carrying ONLY the Allow rule proves the seeded MJAPI ceiling admits
entity:read, so the deny in the first key is genuinely the thing flipping the decision.
SE1 ★ — deny-precedence. Two rules on
entity:read, same priority, one Allow + one Deny → Deny wins (ScopeEvaluator sortsIsDeny DESCat equal priority, so the deny rule is evaluated first and short-circuits). A control key carrying ONLY the Allow rule proves the seededMJAPIceiling admitsentity:read, so the deny in the first key is genuinely the thing flipping the decision.