Function decide_capability 

pub fn decide_capability(
    actor: &Actor,
    resource: &ResourceRef,
    access: Access,
    caps: &[CapOverride],
    now: Option<u64>,
) -> CapDecision

May actor reach resource with access? A live matching grant whose access implies the request allows, unless a live matching restriction caps it below the request. now in Unix seconds; None skips expiry.

Reading is refused only when no live grant covers the resource: every restriction’s access implies Read, so none caps below it.