Function authorize_query 

pub fn authorize_query<A>(
    allow_policies: &[ProcedurePolicy],
    deny_policies: &[ProcedurePolicy],
    args: &A,
    ctx: &CratestackContext,
) -> Result<(), CratestackError>
where
    A: ProcedureArgs + ?Sized,

authorize_procedure for a query block (cratestack#867).

Identical evaluation — the dialect is shared, deliberately (design §6) — with one difference that is not cosmetic: the refusal says “query policy denied this operation”. A schema author debugging a denied query was previously told a procedure had refused them, which sends them looking through a construct they may not have written.