Function account_refusal 

pub async fn account_refusal(
    user_id: Uuid,
) -> Result<Option<Refusal>, ConfigError>

Whether this user may currently be served, and if not, why.

Read from the global directory: a database that cannot be reached cannot record its own failure, so neither flag lives in the tenant.

Errors

Only on infrastructure failure. An unknown user is refused as Disabled.