Function ensure_grant_within 

pub fn ensure_grant_within(
    granted: AccessLevel,
    own: AccessLevel,
    subject: &str,
    file_id: &str,
) -> ClResult<()>

A share manager may not hand out more access than ShareAuthority::grant_ceiling allows.

Manager standing is ownership-derived, not Write-derived (a Read-level creator of a tenant-owned file qualifies), and file_access::get_access_level_with_scope returns a share-link scope’s level uncapped by the holder’s own ACL — so without this a Read manager could mint a write link and redeem it to escalate themselves.