Expand description
Answering “may this caller do this”, in the one grammar the whole framework uses.
A resource’s [permissions], a function’s manifest and [ai] access all
spell access the same way — public, authenticated, member,
role:<name>, private — so the check that enforces it lives here rather
than once per endpoint. Two callers today (functions
and the assistant); the value is that neither can drift
from the other.
Functions§
- check
- Resolve the caller and check them against
access.