Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
One permission: this subject may propose these actions, under these limits (§4.2).
ctrlrun.Grant — class, defined at src/ctrlrun/authority.py:299
class Grant()
def __init__(id: str, subject: Subject, actions: tuple[str, ...], resources: tuple[str, ...] | None, constraints: Mapping[str, Condition], environments: tuple[str, ...] | None, expires_at: datetime | None, delegable: bool)
__post_init__ validates everything the YAML loader validates, so the constructor refuses
exactly what the loader refuses. That is not decoration: Control.delegate takes a Grant
built in Python, and §5.5’s segment relation is undefined on a segment like a**, so
without it item 3’s containment check would be discharging a proof about a value nothing
validated.
Related topics
An IAM agent that can grant read but never adminAuthority YAML referenceAuthority and delegationRunning on PostgresDelegationWas this page helpful?