Role Gate (deny by default)

Write authorize(user, action, resource) — a permission table maps role => allowed actions: admin: all; editor: ["read", "write"]; viewer: ["read"]. Unknown roles and unknown actions must be DENIED (default deny). Return "allow" or "deny".

Difficulty: intermediate