Admission

One function decides whether anything may happen: admit(request). There is no second path, no bypass for administrators, and no sub-function anyone may call directly.

Read The eight gates for what each one does, and Consent for the one whose position in the order is the most argued-about decision in the product.