Resolving the target policy from the updates, with later updates replacing earlier values:

- Update 1: deny_wins=true, expiry_inclusive=true, inherit_roles=true, owner_bypass=true.
- Update 2: action_casefold=false, group_union=false, resource_scope=prefix, suspended_denies=false.
- Update 3: token_ttl=100, wildcard_action=true.
- Update 4: resource_scope=exact, suspended_denies=true.
- Update 5: action_casefold=true, audit_denials=false, default_allow=false, group_union=true.
- Update 6: audit_denials=true, default_allow=true.

Every one of the 14 keys is set by one of these updates.

Some details the specification leaves open, and how I handled them:
- Wildcard grants (action `*`) match only when wildcard_action is on.
- A grant's `effect` is read from `effect` and treated as a deny only when it equals "deny". Anything else counts as an allow.
- A grant's role is read from `role`.
- Missing `expires` is treated as null.
- The token check is `now - issued_at > token_ttl`.
- Prefix scope is implemented with `startsWith`, though exact scope is the active setting.

```json
{"files": {"main.ts": "import {run} from './core.ts';\nimport {POLICY} from './policy.ts';\nexport function evaluate(payload: any): any { return run(payload, POLICY); }\n", "policy.ts": "export const POLICY: any = {deny_wins: true, expiry_inclusive: true, inherit_roles: true, owner_bypass: true, action_casefold: true, group_union: true, resource_scope: 'exact', suspended_denies: true, token_ttl: 100, wildcard_action: true, audit_denials: true, default_allow: true};\n", "helpers.ts": "export function lc(s: any): string { return String(s).replace(/[A-Z]/g, (c) => c.toLowerCase()); }\n", "core.ts": "import {lc} from './helpers.ts';\nexport function run(payload: any, policy: any): any {\n  const subject = payload.subject || {};\n  const resource = payload.resource || {};\n  const now = payload.now;\n  const fin = (allowed: boolean, reason: string, matched: number[]) => ({allowed, reason, matched, audit: (!allowed && policy.audit_denials) ? [reason] : []});\n  if (subject.tenant !== resource.tenant) return fin(false, 'tenant', []);\n  if (now - payload.issued_at > policy.token_ttl) return fin(false, 'token', []);\n  if (policy.suspended_denies && subject.suspended) return fin(false, 'suspended', []);\n  if (policy.owner_bypass && subject.owner) return fin(true, 'owner', []);\n  let initial: string[] = (subject.roles || []).slice();\n  if (policy.group_union) initial = initial.concat(subject.groups || []);\n  const roles = new Set<string>(initial);\n  if (policy.inherit_roles) {\n    const parents = payload.role_parents || {};\n    const stack = Array.from(roles);\n    while (stack.length) {\n      const r = stack.pop() as string;\n      const ps = Object.prototype.hasOwnProperty.call(parents, r) ? (parents[r] || []) : [];\n      for (const p of ps) {\n        if (!roles.has(p)) { roles.add(p); stack.push(p); }\n      }\n    }\n  }\n  const grants = payload.grants || [];\n  const matched: number[] = [];\n  let anyAllow = false;\n  let anyDeny = false;\n  const act = payload.action;\n  for (let i = 0; i < grants.length; i++) {\n    const g = grants[i];\n    if (!roles.has(g.role)) continue;\n    let am = false;\n    if (policy.wildcard_action && g.action === '*') am = true;\n    else if (policy.action_casefold) am = lc(g.action) === lc(act);\n    else am = g.action === act;\n    if (!am) continue;\n    const scope = g.scope === undefined || g.scope === null ? '' : String(g.scope);\n    const rid = String(resource.id);\n    const sm = policy.resource_scope === 'prefix' ? rid.startsWith(scope) : scope === rid;\n    if (!sm) continue;\n    const e = g.expires;\n    if (!(e === null || e === undefined)) {\n      const ok = policy.expiry_inclusive ? now <= e : now < e;\n      if (!ok) continue;\n    }\n    matched.push(i);\n    if (g.effect === 'deny') anyDeny = true; else anyAllow = true;\n  }\n  if (matched.length === 0) return fin(!!policy.default_allow, 'default', []);\n  const allowed = policy.deny_wins ? (anyAllow && !anyDeny) : anyAllow;\n  return fin(allowed, 'grants', matched);\n}\n"}}
```