~/writing
Most permission systems log a denied request and a forged one the same way. Separating them turns a noisy access log into a real signal, and it costs you one shape check.