Module grant 

Permission atoms and sets, as data.

This module owns the shape and the syntax of a permission. The algebra — containment (⊑), meet and join, normalisation, disjointness — lives in boundgraph-grant (feature 02). Keeping the type here lets WorkOrder and the ledger reference permissions without depending on the solver.

Two consequences of Law I are already visible in these types:

• A GrantSet is a BTreeSet, so it has no insertion order and no duplicates. Two sets with the same atoms are the same value and share a digest.
• GrantSet::EMPTY is the default. A step that declares nothing gets nothing; there is no representation of “unrestricted”.

Structs

GrantAtom

One permission, as domain:action:resource.

GrantSet

A set of permissions.

Enums

GrantAtomParseError

An atom did not match domain:action[:resource].

Constants

KNOWN_DOMAINS

The resource families the specification documents.