Module acl 

Functions

approve_scope_from_flags

Resolve the three mutually-exclusive approve flags into the wire value.

cmd_acl_create

cmd_acl_delete

cmd_acl_get

cmd_acl_list

cmd_acl_update

format_approve_scope

Human-readable approve-authority — what this entry may confer via an approval (task-consent delegation / step-up ratification) while acting nowhere. None when it confers nothing, so callers omit the line entirely.

format_contexts

Human-readable context list — role-aware, because an empty allowed_contexts means opposite things depending on the role.

format_role

validate_role