{"id":"policy-first-matching-deny-wins","text":"The policy engine uses first-match semantics — the first matching deny rule raises `PolicyDeniedError`, not the most specific rule.","truth_value":"IN","source":"entries/2026/05/11/changelog.md","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"policy-first-matching-deny-wins","truth_value":"IN","reason":"premise"}]}}