pub fn resolve_admin_scope(
req: &AdminRequestKind,
caller: &PrincipalId,
) -> AuthorityScopeExpand description
Return the authority scope req exercises for caller.
Self-scoped when the target principal equals the caller
(AdminRequestKind::QuotaGet / AdminRequestKind::QuotaSet
/ AdminRequestKind::AgentList — the last scoped as “self” so
agents can see their own row). Everything else is cross-tenant,
including creation / group operations that are intrinsically global.