Function is_identity_allowed_by 

pub fn is_identity_allowed_by(
    allowed: &[String],
    identities: &[&str],
    match_fn: impl Fn(&str, &str) -> bool,
) -> bool

Whether an account is authorized, evaluated across every identifier it is known by, against a single snapshot of the resolved peer list.

Asking is_user_allowed_by once per identifier and OR-ing the answers is not equivalent. A deny names one identifier while the wildcard grants every other, so the deny goes false on its own identifier and the wildcard goes true on the next one, and the account is admitted. Any channel that accepts more than one identifier for the same sender, or that resolves the peer list more than once while deciding, has that hole.