Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
One permission: this subject may propose these actions, under these limits (§4.2).
ctrlrun.Grant — class, defined at src/ctrlrun/authority.py:299
from ctrlrun import Grant
class Grant
def __init__(id: str, subject: Subject, actions: tuple[str, ...] = (), resources: tuple[str, ...] | None = None, constraints: Mapping[str, Condition] = (lambda: NO_CONSTRAINTS)(), environments: tuple[str, ...] | None = None, expires_at: datetime | None = None, delegable: bool = False)
__post_init__ validates everything the YAML loader validates, so the constructor refuses
exactly what the loader refuses. That is not decoration: Control.delegate takes a Grant
built in Python, and §5.5’s segment relation is undefined on a segment like a**, so
without it item 3’s containment check would be discharging a proof about a value nothing
validated.
Related topics
An IAM agent that can grant read but never adminAuthority YAML referenceAuthority and delegationRunning on PostgresDelegationWas this page helpful?