Function authorize_topics_logged 

pub fn authorize_topics_logged<'a>(
    authorizer: &dyn Authorizer,
    source: &dyn AclSource,
    principal: &Principal,
    host: &SocketAddr,
    operation: AclOperation,
    topic_names: impl IntoIterator<Item = &'a str>,
    log_denied: bool,
) -> HashMap<&'a str, AuthorizationResult>

authorize_topics with Kafka’s logIfDenied flag. With log_denied off each name goes through Authorizer::authorize_quiet, and a Deny leaves no audit record and no counter behind.

Metadata is the caller that turns it off: for all topics it filters every topic by Describe and hides the denied ones, so a Deny there is not a refusal (logIfDenied = !metadataRequest.isAllTopics).