pub const KEY_PREFIX: &str = "shell:";
The namespace every shell key carries, so a key can never collide with the bare tool name a non-shell grant uses.