pub fn authorize_csr(
csr: &CertificationRequest<'_>,
identity: &str,
policy: &EnrollAuthzPolicy<'_>,
) -> Result<(), String>Expand description
Authorize a parsed CSR against the authenticated identity and label policy.
Returns Ok(()) when the request is authorized, or Err(reason) with a
human-readable explanation suitable for a 403 Forbidden response and an
enroll.reject audit detail. The reason never echoes secret material —
only the requested names, which the client already knows.