> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ctrlrun.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant

> One permission: this subject may propose these actions, under these limits (§4.2).

`ctrlrun.Grant` — class, defined at `src/ctrlrun/authority.py:299`

```python theme={null}
class Grant()
    def __init__(id: str, subject: Subject, actions: tuple[str, ...], resources: tuple[str, ...] | None, constraints: Mapping[str, Condition], environments: tuple[str, ...] | None, expires_at: datetime | None, delegable: bool)
```

One permission: this subject may propose these actions, under these limits (§4.2).

`__post_init__` validates everything the YAML loader validates, so the constructor refuses
exactly what the loader refuses. That is not decoration: `Control.delegate` takes a `Grant`
built in Python, and §5.5's segment relation is undefined on a segment like `a**`, so
without it item 3's containment check would be discharging a proof about a value nothing
validated.

## Next

* [Python API index](/reference/api/index).
* [Get started](/get-started/quickstart) · [Why](/why).


## Related topics

- [An IAM agent that can grant read but never admin](/cookbook/iam-agent.md)
- [Authority YAML reference](/reference/authority-yaml.md)
- [Authority and delegation](/authority.md)
- [Running on Postgres](/postgres.md)
- [Delegation](/reference/api/Delegation.md)