Chapter 10.3 Question about lifetime constraints

[dp304]

The lifetime-annotated longest function has the following signature:
fn longest<'a>(x: &'a str, y: &'a str) -> &'a str;
The book says:

The function signature now tells Rust that for some lifetime 'a, the function takes two parameters, both of which are string slices that live at least as long as lifetime 'a. The function signature also tells Rust that the string slice returned from the function will live at least as long as lifetime 'a.

In my view (although all these concepts are new to me, and I haven't looked at how the Rust implementation actually works), the policy to be enforced should rather be that the return value lives at most as long as lifetime 'a, or else it could become a dangling reference. Am I understanding something wrong?

[carols10cents]

Yes, please take a look at the extensive discussion here: #1875