Function peer_grant_identity 

pub fn peer_grant_identity(entry: &str) -> Option<&str>

The grant identity entry names, or None when entry is a deny marker.

Grants and denies share one string channel, so the encoding has to stay injective even when the identity itself opens with the marker character. RFC 5322 permits ! to open an email local-part, and the email and Gmail matchers take full addresses through this helper, so !user@example.com is an address an operator may legitimately grant or ignore. The two cases must not collide: an encoding that maps a grant of !x and a deny of !x onto the same string silently inverts one of them, which on an authorization surface is the whole failure mode.

So the count of leading markers carries the decision, not merely its presence. An identity opening with k markers is emitted with 2k for a grant and 2k + 1 for a deny: an even run is a grant, an odd run is a deny, and halving the run recovers the identity in both cases. An identity that does not open with the marker keeps the original encoding, so every existing config and every entry in a persisted config.toml reads exactly as before.

identity	as a grant	as a deny
alice	alice	!alice
!alice	!!alice	!!!alice

Pairs with peer_grant_marker and peer_deny_marker.