What does this object-level authorization policy print?

function mayRead(principal, order) {
  if (principal.tenantId !== order.tenantId) return false;
  return order.ownerId === principal.subject ||
    principal.permissions.includes('orders:read:any');
}

const order = { tenantId: 't-1', ownerId: 'u-7' };
console.log(mayRead(
  { subject: 'u-7', tenantId: 't-1', permissions: [] }, order,
));
console.log(mayRead(
  { subject: 'u-7', tenantId: 't-2', permissions: ['orders:read:any'] }, order,
));