Function peer_policy_admits 

pub fn peer_policy_admits(
    allowed: &[String],
    identities: &[&str],
    match_fn: impl Fn(&str, &str) -> bool,
) -> bool

Whether a resolved peer list authorizes an account, across every identifier it is known by. Denies are applied before any grant, including a wildcard.

Asking per identifier and OR-ing the answers is not equivalent: a deny names one identifier while the wildcard grants every other, so the deny goes false on its own identifier and the wildcard goes true on the next one, and the account is admitted.