Grant

Grant — Authorization Decision

Token verify → capability trie → entitlement → allow/deny + audit.

Grant — Authorization Decision (v2026-09-30T093920Z-5e473105f4) 2026-09-30 | Token verify → capability trie → entitlement → allow/deny + audit. 1 - Token Verification - Verify the token check daemon/src/grant/__init__.py:check GET /api/grant/auth/login Token verification get_subject daemon/src/grant/__init__.py:get_subject GET /api/auth/google/callback Extract subject from token token 2 - Capability Trie - Match capabilities entitlements daemon/src/grant/__init__.py:entitlements GET /api/grant/entitlements Retrieve entitlements account_classes.json daemon/src/grant/account_class.py:_load daemon/config/account_classes.json Account class configuration entitlements 3 - Entitlement - Allow/Deny Decision require daemon/src/grant/__init__.py:require GET /api/backlog/{ticket} Check entitlement oauth_client daemon/src/google_signin_api.py:_client_config OAuth client configuration entitlement 1. Token verification 2. Extract subject from token 3. Retrieve entitlements 4. Check entitlement 5. Allow/Deny decision 6. Audit decision Token payload {"sub": "user:12345", "exp": 1672531200} Entitlements response {"resource_pattern": "api://backlog/ticket", "ops": ["read", "write"]} Token verification and subject extraction are handled by the `check` and `get_subject` functions. Entitlements are retrieved from the `account_classes.json` configuration file. The `require` function checks the entitlements against the requested operation. Legend actor = initiates work · process = code path · store = state on disk · bus = durable queue · dashed = separate process cyan = request flow · pink = state read/write · dashed green = pull / return path · red = refusal As of 2026-09-30 09:39 UTC, from commit 5e47310

Provenance

This drawing is generated, not drawn. It is rebuilt from the source files below, so when they change the picture changes — a diagram here cannot quietly describe a system that no longer works this way.

Owner
Grant
Slug
grant-authorization
Rendered
2026-09-30T093920Z
From commit
5e473105f4
Updated
30 Sep 2026, 09:39 UTC
Sources at
5e47310
Watches
3 paths
  • daemon/src/grant
  • daemon/src/google_signin_api.py
  • daemon/docs/vault/grant-spec.md