CommandAuthorizer

Decides whether a caller may send a command, before its body is decoded (step 3). The instance-level check, whether the aggregate belongs to the caller's scope, is the kernel's, not an authorizer's.

A node's authorizers are all asked (allOf): Authorization.Allowed means this authorizer has no objection, not that the command is allowed whatever the others say, and there is no abstaining. An authorizer of one concern (the service identities' calls, the commands no caller may forge) allows the actions outside it.