X_POLICY_CLAUSE_EMPTY

a policy combinator was built with no clauses

and() answered allowed and admitsAnonymous(and()) agreed, so policy: and(...caps.map(can)) over a list that filtered to empty admitted an anonymous caller on all four surfaces — and because meta.auth derives from admitsAnonymous, http did not 401 first. The label rendered as and(), so there was no diagnostic. or() fails closed but denies with no clause allowed this actor, a reason naming no clause. Both are refused where they are written, the allowHosts: [] precedent

allow('public') is the spelling for "no clauses required"; deny('<reason>') is the one that carries a reason