Status: IN
The policy engine uses first-match semantics — the first matching deny rule raises `PolicyDeniedError`, not the most specific rule.
Source: entries/2026/05/11/changelog.md
JSON