Merges the request's options onto the entity's configured defaults under the rules above.
The root entity's clone configuration, or null when it has none.
The options the caller sent.
What the caller is authorized to do beyond the configuration.
Merges the request's options onto the entity's configured defaults under the rules above.