admitted

The tree of state as caller may see it, masked, or null when its policies hide it from the caller. An HTTP caller naming a scope or tenants it may not is refused first (QueryTargets.recheck).