D004 — Leaf cannot touch billing, even if authz is skipped

Status: accepted
Step: 4

verae-nats-accounts/policy.json is the allow-list. access-leaf refuses any target not in the leaf set. nats.conf documents INTERNAL vs LEAF accounts for when the lab cluster is replaced with a real accounts-enabled nats-server.