Function decide 

pub fn decide<'g>(
    grants: impl IntoIterator<Item = &'g Grant>,
    subjects: &[Subject],
    node: &TreePath,
    kind: ActionKind,
    cx: &Context<'_>,
) -> Decision<'g>

Decides for one set of subjects over one set of grants:

1. Take the live grants whose subject is one of subjects, whose node is node or an ancestor of it, and whose kinds include kind.
2. The most specific node wins.
3. At the same node, Deny beats Ask beats Allow.
4. No grant: Deny.