PermissionGrant

A single permission grant scoped to an OT name or wildcard pattern.

Detailed description

Grants can be time-limited, session-scoped, or persistent. Deny grants override allow grants at the same or broader level.

A pattern matches its exact scope name. A wildcard pattern such as catalog.* matches exactly one more segment: catalog.capture, but not catalog.capture.read. A timed grant is valid until expiresAt; the other scopes do not expire by time.

See also PermissionStore, Operator.