Function authorize_whole_config_write 

pub fn authorize_whole_config_write(
    request: &RequestPrincipal,
    verbs: &[Verb],
    guard: &ConfigCommit,
) -> Result<ConfigWriteAuthorization, WriteDenied>

A rewrite whose write set cannot be enumerated before it runs (a schema migration of the file, a Quickstart apply): a scoped principal needs the wildcard selector and every verb the rewrite may exercise. Nothing narrower can be honoured, so nothing narrower is accepted.