Repo: darkedges/pf12.3-biscuit-datalog-tokens We've covered why a hybrid works, the token generator plugin, and the Terraform plus end-to-end test. Part 3 ended with alice holding orders:write and still getting a 403 . This part unlocks that write, narrows the token in a few ways, and then says plainly what doesn't work yet. 1. Why the write was refused orders-api's policy has three rules: allow if scope("orders:read"), operation("read"); allow if scope("orders:w...