Decides whether a new key may be enrolled in a role, or used as a first
factor.
Answers about enrolment only: a key already enrolled in a role since
switched off goes on working. Asks the realm's authentication policy
after this module's own settings.
Parameters
role: any
primary or mfa
Returns any
{ ok: true }, or { ok: false, why } carrying an error code
Decides whether a new key may be enrolled in a role, or used as a first factor.
Answers about enrolment only: a key already enrolled in a role since switched off goes on working. Asks the realm's authentication policy after this module's own settings.