> ## Documentation Index
> Fetch the complete documentation index at: https://ctrlrun.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant

> One permission: this subject may propose these actions, under these limits (§4.2).

`ctrlrun.Grant` — class, defined at `src/ctrlrun/authority.py:299`

```python theme={null}
from ctrlrun import Grant
```

```python theme={null}
class Grant
    def __init__(id: str, subject: Subject, actions: tuple[str, ...] = (), resources: tuple[str, ...] | None = None, constraints: Mapping[str, Condition] = (lambda: NO_CONSTRAINTS)(), environments: tuple[str, ...] | None = None, expires_at: datetime | None = None, delegable: bool = False)
```

One permission: this subject may propose these actions, under these limits (§4.2).

`__post_init__` validates everything the YAML loader validates, so the constructor refuses
exactly what the loader refuses. That is not decoration: `Control.delegate` takes a `Grant`
built in Python, and §5.5's segment relation is undefined on a segment like `a**`, so
without it item 3's containment check would be discharging a proof about a value nothing
validated.

## Next

* [Python API index](/reference/api/index).
* [Get started](/get-started/quickstart) · [Why](/why).


## Related topics

- [An IAM agent that can grant read but never admin](/cookbook/iam-agent.md)
- [Authority YAML reference](/reference/authority-yaml.md)
- [Authority and delegation](/authority.md)
- [Running on Postgres](/postgres.md)
- [Delegation](/reference/api/Delegation.md)