Function resolve 

pub fn resolve(chain: &AuthzChain<'_>, ctx: &AuthzContext<'_>) -> Resolved

authorize with the dry-run observation attached (DW-041): the enforced verdict plus the would-have-denied attachment for the caller to log and count. See Resolved for why a dry deny never masks a live one.