Refuses an API action early, on facts about the caller alone, before the action parses a body or loads anything.

plug AuthorizeAction, {:project_users, :access_project} when action == :show

It runs after the pipeline has authenticated the caller. It builds the caller's Lightning.Scope and asks Lightning.Policies.Permissions.permit/3, which checks only the token grant. A refusal is answered by LightningWeb.API.FallbackController. A pass assigns the scope as :scope for the action to reuse. Passing is not permission: an action with a target still asks about it through LightningWeb.API.Target.