Durable key-value state on the account. Keys under the plugin’s own id (<id>.<rest>) need no grant; others need values.read:<prefix> / values.write:<prefix>.
<id>.<rest>
values.read:<prefix>
values.write:<prefix>