Checks every access list covers the requirement (RFC 9767 section 2.1.6).
the token's access lists
the access the request needs
a refusal, or null
Checks every access list covers the requirement (RFC 9767 section 2.1.6).