Grant

Grant — Authorization Decision

Token verify → capability trie → entitlement → allow/deny + audit.

Grant — Authorization Decision (v2026-08-02T101544Z-ab2bbdebf5) 2026-08-01 | Token verify → capability trie → entitlement → allow/deny + audit. 1 - AUTHORIZATION CHECK get_subject __init__.py GET /api/vault/{mount}/{path:path} resolve subject from request headers check daemon/src/grant/__init__.py:48 async def check(subject: str, resource: str, op: str) -> bool: check if subject can perform op on resource reg_keys table daemon/src/grant/accounts.py:107 INSERT OR IGNORE INTO reg_keys (key_hash, account_class, created_at) VALU… registration keys storage subject resource 2 - ACCOUNT CLASS RESOLUTION resolve daemon/src/grant/account_class.py:30 def resolve(account_class: str, *, _config: dict | None = None) -> dict: map account_class to feature bundle account_classes.json daemon/config/account_classes.json tier: free | pro | institutional feature keys available per account class account_class 3 - ENTITLEMENT EVALUATION entitlements_for daemon/src/grant/accounts.py:58 def entitlements_for(account_class: str) -> tuple[str, ...]: return feature keys for account class permissions table daemon/src/grant/db.py INSERT INTO permissions (user_id, permission) VALUES (?, ?) user permissions storage account_class 1. get_subject resolves subject from request h… 2. check verifies if subject can perform op on… 3. resolve maps account_class to feature bundle 4. entitlements_for returns feature keys for a… JWT Token Payload {"sub": "user:123", "email": "user@example.com", "tier": "pro"} Account Class JSON {"tier": "pro", "skin": "pro-skin", "plugins": ["plugin1", "plugin2"]} The source does not show any direct interaction with an external process or third party in this subsystem. Legend actor = initiates work · process = code path · store = state on disk · bus = durable queue · dashed = separate process cyan = request flow · pink = state read/write · dashed green = pull / return path · red = refusal

Provenance

This drawing is generated, not drawn. It is rebuilt from the source files below, so when they change the picture changes — a diagram here cannot quietly describe a system that no longer works this way.

Owner
Grant
Slug
grant-authorization
Rendered
2026-08-02T101544Z
From commit
ab2bbdebf5
Watches
2 paths
  • daemon/src/grant
  • daemon/docs/vault/grant-spec.md