pub const DENY_SCOPE: &str = "soma:__deny__";
Sentinel scope no token can hold; assigned to unknown actions to deny them.