Resolving the policy for the target project, I apply each update in order. Archived records belong to other projects and are ignored.

Initial values were not given for every key, so I fill them from the updates:
- deny_wins: false (Update 1)
- expiry_inclusive: false (Update 1)
- inherit_roles: false (Update 1)
- owner_bypass: false (Update 1)
- action_casefold: true (Update 2), then false (Update 5)
- group_union: true (Update 2), then false (Update 5)
- resource_scope: exact (Update 2), then prefix (Update 4)
- suspended_denies: true (Update 2), then false (Update 4)
- token_ttl: 200 (Update 3)
- wildcard_action: false (Update 3)
- audit_denials: true (Update 5), then false (Update 6)
- default_allow: true (Update 5), then false (Update 6)

The "any allow suffices" rule applies because deny_wins is false.

The code reads the grant fields role, action, scope, expires and effect. The spec does not name the effect field, so I assume `effect` with the values "allow" and "deny". I treat a grant as a deny only when its effect is "deny", and as an allow otherwise.

```json
{"files":{"main.ts":"import {run} from './core.ts';\nimport {POLICY} from './policy.ts';\nexport function evaluate(payload: any): any { return run(payload, POLICY); }\n","policy.ts":"export const POLICY: any = {\n  deny_wins: false,\n  expiry_inclusive: false,\n  inherit_roles: false,\n  owner_bypass: false,\n  action_casefold: false,\n  group_union: false,\n  resource_scope: 'prefix',\n  suspended_denies: false,\n  token_ttl: 200,\n  wildcard_action: false,\n  audit_denials: false,\n  default_allow: false,\n};\n","helpers.ts":"export function lower(s: any): string { return String(s).replace(/[A-Z]/g, (c) => c.toLowerCase()); }\n","core.ts":"import {lower} from './helpers.ts';\n\nexport function run(payload: any, policy: any): any {\n  const subject = payload.subject || {};\n  const resource = payload.resource || {};\n  const fin = (allowed: boolean, reason: string, matched: number[]) => ({\n    allowed,\n    reason,\n    matched,\n    audit: !allowed && policy.audit_denials ? [reason] : [],\n  });\n  if (subject.tenant !== resource.tenant) return fin(false, 'tenant', []);\n  if (payload.now - payload.issued_at > policy.token_ttl) return fin(false, 'token', []);\n  if (policy.suspended_denies && subject.suspended) return fin(false, 'suspended', []);\n  if (policy.owner_bypass && subject.owner) return fin(true, 'owner', []);\n  let list: string[] = (subject.roles || []).slice();\n  if (policy.group_union) list = list.concat(subject.groups || []);\n  const roles = new Set<string>(list);\n  if (policy.inherit_roles) {\n    const parents = payload.role_parents || {};\n    const stack = Array.from(roles);\n    while (stack.length) {\n      const r = stack.pop() as string;\n      const ps = parents[r] || [];\n      for (const p of ps) {\n        if (!roles.has(p)) { roles.add(p); stack.push(p); }\n      }\n    }\n  }\n  const grants = payload.grants || [];\n  const matched: number[] = [];\n  let anyAllow = false;\n  let anyDeny = false;\n  const rid = String(resource.id);\n  for (let i = 0; i < grants.length; i++) {\n    const g = grants[i];\n    if (!roles.has(g.role)) continue;\n    let actOk: boolean;\n    if (policy.wildcard_action && g.action === '*') actOk = true;\n    else if (policy.action_casefold) actOk = lower(g.action) === lower(payload.action);\n    else actOk = g.action === payload.action;\n    if (!actOk) continue;\n    const scope = String(g.scope);\n    const scopeOk = policy.resource_scope === 'prefix' ? rid.startsWith(scope) : scope === rid;\n    if (!scopeOk) continue;\n    if (g.expires !== null && g.expires !== undefined) {\n      const ok = policy.expiry_inclusive ? payload.now <= g.expires : payload.now < g.expires;\n      if (!ok) continue;\n    }\n    matched.push(i);\n    if (g.effect === 'deny') anyDeny = true; else anyAllow = true;\n  }\n  if (matched.length === 0) {\n    return fin(!!policy.default_allow, 'default', []);\n  }\n  const allowed = policy.deny_wins ? (anyAllow && !anyDeny) : anyAllow;\n  return fin(allowed, 'grants', matched);\n}\n"}}
```