Interface AuthorizationResult

Whether access is allowed

Observability record of the effective row filter for this authorization — what the usage log records and what a consumer inspects when debugging. NOT the enforcement contract: enforcement is the data layer (EntityInfo.GetEffectiveRowFilterWhereClause).

All rules evaluated during the check

The app-level rule that matched (if any)

The key-level rule that matched (if any). For compatibility this remains the HIGHEST-PRIORITY matching allow rule even though evaluation no longer stops there.

RowFilterIDs carried by EVERY matching key-level allow rule (deduped, sorted for determinism). A higher-priority unfiltered allow rule cannot shadow a lower-priority filtered one — most-restrictive-wins, so all matching allow rules' filters are collected. Empty/absent when no matching allow rule carries a filter.

Human-readable reason for the decision

Row-filter bindings resolved from the matching filtered allow rules (entity + permission type + filter). Populated only on an Allowed result for a key whose matching rules carry row filters. These are the same bindings context.ts stamps onto the per-request UserInfo for data-layer enforcement.