Function authorize 

pub fn authorize(chain: &AuthzChain<'_>, ctx: &AuthzContext<'_>) -> Decision

Resolve the precedence chain. Merge semantics (documented, frozen):

1. A deny at ANY level wins (denials are absolute; a consumer-level deny beats a route-level allow and vice versa).
2. Otherwise the most specific level WITH rules governs: its verdict is final and less-specific levels are not consulted.

Dry run (DW-041) refines rule 1 per level: a deny from a dry_run block does not STOP the walk — it is recorded in Resolved::would_deny and the walk continues, so a LIVE deny at a less specific level still enforces. A config with no dry_run blocks resolves exactly as before (every deny is live, the walk stops at the first one).