Function acl_decision 

pub fn acl_decision(facts: AclFacts) -> AclDecision

Decide a request from whether any matching ACL allowed or denied it.

Kafka’s AclAuthorizer.authorizeAction order: a super user is always allowed; otherwise a matching DENY wins over any ALLOW; otherwise a matching ALLOW allows; otherwise default_decision decides. It reflects allow.everyone.if.no.acl.found (default false), which allows a request only when no ACL at all applies to the resource, so it never overrides an explicit ALLOW or DENY.