code: func (p *PolicyAuthorizer) KeyWritePrefix(prefix string) bool {
  	// Look for a matching rule that denies
  	prefixAllowed := true
  	found := false
  
  	// Look for a prefix rule that would apply to the prefix we are checking
  	// WalkPath starts at the root and walks down to the given prefix.
  	// Therefore the last prefix rule we see is the one that matters
  	p.keyRules.WalkPath(prefix, func(path string, leaf interface{}) bool {
  		rule := leaf.(*policyAuthorizerRadixLeaf)
  
  		if rule.prefix != nil {
  			found = true
  			if rule.prefix.(RulePolicy).aclPolicy != PolicyWrite {
  				prefixAllowed = false
  			} else {
  				prefixAllowed = true
  			}
  		}
  		return false
  	})
  
  	if !prefixAllowed {
  		return false
  	}
  
  	// Look if any of our children do not allow write access. This loop takes
  	// into account both prefix and exact match rules.
  	deny := false
  	p.keyRules.WalkPrefix(prefix, func(path string, leaf interface{}) bool {
  		found = true
  		rule := leaf.(*policyAuthorizerRadixLeaf)
  
  		if rule.prefix != nil && rule.prefix.(RulePolicy).aclPolicy != PolicyWrite {
  			deny = true
  			return true
  		}
  		if rule.exact != nil && rule.exact.(RulePolicy).aclPolicy != PolicyWrite {
  			deny = true
  			return true
  		}
  
  		return false
  	})
  
  	// Deny the write if any sub-rules may be violated
  	if deny {
  		return false
  	}
  
  	// If we had a matching rule, done
  	if found {
  		return true
  	}
  
  	// No matching rule, use the parent.
  	return p.parent.KeyWritePrefix(prefix)
  }
docs: // KeyWritePrefix returns if a prefix is allowed to be written
  //
  // This is mainly used to detect whether a whole tree within
  // the KV can be removed. For that reason we must be able to
  // delete everything under the prefix. First we must have "write"
  // on the prefix itself