Module grants 

Resolved authorization grants — the single runtime authorization vocabulary (RFC 7141).

The grant vocabulary is resource × verb over enum-typed resource classes, plus three fine-grain selectors (agent aliases, config write paths, tool names) and an admin short-circuit. Providers never construct these: the shared principal resolver maps verified claims / roster entries through configured permission profiles into one merged ResolvedGrants, re-resolved whenever the authorization-policy generation changes.

Deny-by-default, Rev 8 semantics: an empty grant set permits nothing, and an EMPTY SELECTOR LIST GRANTS NO INSTANCES — broad access requires the explicit WILDCARD selector or an administrator grant. Every RPC method and gateway route classifies itself to exactly one (Resource, Verb) pair, so a request either matches a held grant or is refused — there is no unclassified traffic. Operations with a fine-grained selector require BOTH the resource-verb grant AND a matching selector (composition by intersection).

Structs

ResolvedGrants

The merged authorization result for one principal: what it may touch and how. Produced by the shared grant resolver from permission profiles at a specific authorization-policy generation; consumed by dispatch classification, the gateway router, and deep resource checks. Never stored on a Principal — consumers re-resolve when the generation changes.

ResourceIter

An iterator over the variants of Resource

VerbIter

An iterator over the variants of Verb

Enums

Resource

Every grantable resource class in the system. One variant per RPC/gateway-addressable surface; a new surface must add its variant here and classify its methods before it can be dispatched.

Verb

What may be done to a Resource.

Constants

WILDCARD

The explicit all-instances selector for allowed_agents, allowed_tools, and config_write_paths. Broad access is always this explicit token (or admin) — never an empty list.