Function decide 

pub fn decide(token: Option<&TokenRow>, directory: &str, now: i64) -> Decision

public is always allowed; any other directory needs a live credential granted it, and a live credential without that grant sees the directory as absent.