SE4 ★ — the unscoped-key default. A key with NO rule for entity:read (but an application ceiling
that DOES admit it) resolves by the evaluator's defaultBehaviorNoScopes. Driving the REAL
ScopeEvaluator twice over the identical key + cache — once 'allow', once 'deny' — proves the
branch flips the decision. Then the shared GetAPIKeyEngine() (which the server actually uses) is
asserted to deny, pinning that the production default is the SAFE one ('deny'), even though a bare
new ScopeEvaluator() defaults to 'allow'.
SE4 ★ — the unscoped-key default. A key with NO rule for
entity:read(but an application ceiling that DOES admit it) resolves by the evaluator'sdefaultBehaviorNoScopes. Driving the REALScopeEvaluatortwice over the identical key + cache — once'allow', once'deny'— proves the branch flips the decision. Then the sharedGetAPIKeyEngine()(which the server actually uses) is asserted to deny, pinning that the production default is the SAFE one ('deny'), even though a barenew ScopeEvaluator()defaults to'allow'.