private String buildAuditMessage(
        KafkaPrincipal principal,
        AuthorizableRequestContext context,
        Action action,
        MatchingRule rule
    ) {
        StringBuilder bldr = new StringBuilder();
        bldr.append("Principal = ").append(principal);
        bldr.append(" is ").append(rule.result() == ALLOWED ? "Allowed" : "Denied");
        bldr.append(" operation = ").append(action.operation());
        bldr.append(" from host = ").append(context.clientAddress().getHostAddress());
        bldr.append(" on resource = ");
        appendResourcePattern(action.resourcePattern(), bldr);
        bldr.append(" for request = ").append(ApiKeys.forId(context.requestType()).name);
        bldr.append(" with resourceRefCount = ").append(action.resourceReferenceCount());
        bldr.append(" based on rule ").append(rule);
        return bldr.toString();
    }
Authorize an action based on the current set of ACLs.

In order to know whether to allow or deny the action, we need to examine the ACLs
that apply to it. If any DENY ACLs match, the operation is denied, no matter how
many ALLOW ACLs match. If neither ALLOW nor DENY ACLs match, we return the default
result. In general it makes more sense to configure the default result to be
DENY, but some people (and unit tests) configure it as ALLOW.
metadata/src/main/java/org/apache/kafka/metadata/authorizer/StandardAuthorizerData.java