> unless an explicit policy grants permission

Three months later, all devs have “Allow *” in their tool-name.conf