Function require_all 

pub fn require_all(expr: Expr) -> Expr

Rewrites a permission expression so every top-level alternative must match, instead of any one of them.

This is what “strict write scoping” means in a codebase where scopes became expressions. compile_scopes joins a subject’s scopes with Or, so a user scoped to two projects may write anything in either. Under strict mode an entry must satisfy all of them — in practice, be in both.

Only the top-level Or chain is rewritten. Nested groups an author wrote by hand are left alone: (a OR b) AND c was deliberate, and silently turning its inner alternation into a conjunction would change a rule its author already expressed precisely. Strictness is about the implicit OR that scope-joining introduced, not about second-guessing explicit logic.

Strict mode can only ever narrow what is permitted. That direction matters: a bug here should lock someone out, not let them through.