PermissionStore

Holds permission grants for an operator and evaluates requests.

Detailed description

Implements the deny-overrides-allow rule: if a deny grant matches the requested scope, the request is denied regardless of any allow grants. If no deny matches and at least one valid allow matches, the request is granted. Otherwise the request must go to sentient for approval.

See also PermissionGrant, Operator.