What is granted
-
holder - The person or agent that holds the authority.
-
resource - The product kind and exact resource identifier the grant names.
-
actions - The acts the holder may exercise on that resource.
-
pass-on - Separate authority to delegate; the right to use something alone does not grant the right to give it away.
-
lineage - The grant a delegated grant derives from, with its constraints and time window.
-
revision - The reading of the grant log a decision used. A stale decision is not proof of current authority.
Product registration
An application registers the resource kinds, relations and actions it serves. Its placements identify the concrete resources. The permission model explains what an action means; neither a display label nor a client-selected role can invent a new right.
Delegation and revocation
A delegated grant derives from authority the issuer holds. The right to exercise an action does not automatically include permission to delegate it. Time windows, identity state and revoked ancestors can affect whether that authority remains usable.
Decisions and streams
The API provides single and batch checks, explanation routes and a grant-change stream. A batch answers its checks in order at one revision. A client enforcing grant bindings must track the stream’s revision and honour its admission contract; possession of a token alone is not proof of a fresh decision.
Diagnose the named failure
Use the reason and resource in the refusal to find the missing authority. Do not give broad permissions as a substitute for understanding the failed action. Access and refusals gives the sequence.