Thanks guys, this is a first step.
I moved declaration to the top of my script :

********START SCRIPT *************

var n = 0;
var final_status = 403;
var servicesCodes = ['rest','oass'];
var requestCount = servicesCodes.length;

function authorize(req, res) {
req.warn('Variables init ...');

function done(reply) { //Callback for completed subrequests ...
n++;
reply.warn('at start of done function, n is :' + n);
if (n < requestCount) { //| final_status !=200) {
reply.warn('status of subrequest is :' + reply.status);
if (reply.status == 200) {
reply.warn('lets set final_status to 200');
final_status = 200;
reply.warn('Value of final_status :' + final_status);
reply.warn('!!! We return 200 because we have this one at least, no matter if other are 404 !!!');
res.return(200);
}
} else { // last response
reply.warn('status of last subrequest is :' + reply.status);
if (reply.status == 200) {
reply.warn('lets set final_status for last subrequest to 200');
final_status = 200;
reply.warn('Value of final_status after last subrequest:' + final_status);
reply.warn('!!! We return the final 200 !!!');
res.return(200);
} else { // we did not get any 200
reply.warn('!!! We return the final 403 !!!');
res.return(403);
}
}
};

req.warn('n is :' + n);
req.warn('final_status is : ' + final_status);
req.warn('servicesCodes is : ' + servicesCodes);
req.warn('requestCount is : ' + requestCount);

for (var i = 0; i < requestCount; i++) {
req.warn('Final status before sending subrequest to next service is '+ final_status)
if (final_status == 200) {
req.warn('We stop here because we have the 200 !!!');
break;
} else {
req.warn('subrequest is on : ' + servicesCodes[i]);
req.subrequest("/" + servicesCodes[i] + "/TestDevice1.html", '', done);
}
}
}


********END SCRIPT *************

However, when i run it, the result is as below :
The suprising thing is the order it is logged : it seems : as we go for async, perhaps both request are started at the same time so each one get a starting of 403 (no yet updated). Could this be the pb ? What could be the solution ? Run subrequest without giving the done function as callback and directly test the return status ?

2018/10/30 21:43:06 [warn] 9220#9220: *203 js: Variables init ...
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: n is :0
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: final_status is : 403 // This is set by the variable declaration
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: servicesCodes is : rest,oass // Loop to subrequest for each services
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: requestCount is : 2
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: Final status before sending subrequest to next service is 403 // Start of the loop with rest : final_status is still original value of 403
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: subrequest is on : rest // it returns an HTTP/200 so final_status is configured to 200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: Final status before sending subrequest to next service is 403 // However, here, final_status is seen as being 403 so we still go over the loop for the second service oass even if there is a break statement based on final_status == 200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: subrequest is on : oass
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: at start of done function, n is :1
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: status of subrequest is :200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: lets set final_status to 200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: Value of final_status :200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: !!! We return 200 because we have this one at least, no matter if other are 404 !!!
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: at start of done function, n is :2
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: status of last subrequest is :200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: lets set final_status for last subrequest to 200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: Value of final_status after last subrequest:200
2018/10/30 21:43:06 [warn] 9220#9220: *203 js: !!! We return the final 200 !!!