Function api_denial 

pub fn api_denial(
    acl: &Effective,
    user: &str,
    method: &str,
    path: &str,
    body: &[u8],
    review_repo: impl Fn(&str) -> Option<String>,
) -> Option<Denial>

The ACL decision for one platform-API request, or None when it is allowed.

Unknown /api/ paths are denied. They reach no handler today, so the only behaviour this changes is for an endpoint added later without a row here — which should fail closed rather than ship unauthorized.