Verify proposed actions against a mandate

Deny-by-default: an action matching no grant is denied. Returns a receipt per action with the decision, the grant that decided it, every violation (not just the first) and a digest that pins the evaluation. Send one "action" or up to 500 in "actions" — billing is one unit per action verified.