Function authorize_config_write 

pub fn authorize_config_write(
    request: &RequestPrincipal,
    writes: ConfigWriteSet,
    guard: &ConfigCommit,
) -> Result<ConfigWriteAuthorization, WriteDenied>

Authorize one mutation’s complete write set for the request’s principal, before the mutation’s first side effect and under the config write lock. Every path needs both the Config verb its effect requires and a matching config path selector, checked against the principal’s current grants. The open posture and an admin principal are unrestricted, as everywhere else.