the question: application, kind (one of ISSUANCE),
subject, claims, realm, and optionally risk, session, device and
deviceDeferred
{ allowed, decision, why, roles, required, policy }, where
allowed is what the caller branches on
Asks whether something may be issued: a session, a token, an assertion, a ticket.
Refuses first for a realm being removed (STS-CORE-0121) and a disabled account (STS-AUTHN-0201). With no decider installed every other call is allowed; otherwise the embedded PEP decides on roles, risk and the registered device. Never throws and never returns a promise; a decider that throws is logged (STS-XACML-0052) and the issuance allowed.