Provider health and policy enforceability from one managed snapshot.
Whether managed policy is both readable and enforceable.
Rejections are excluded on purpose: they are values policy declared and the runtime ignored, which is the documented behavior for a key that cannot grant a privilege. They still have to be reported, so they are carried here rather than folded into the verdict.
