Interface: CompiledGrant

Defined in: shared/access/types.ts:140

A grant compiled for in-memory evaluation: the grant joined with the flat permission set of its (current) role version. This is what the kernel walks — no DB access happens inside evaluateAccess.

PropertiesCopy Anchor Link

condition?Copy Anchor Link

optional condition?: ConditionLogicNode;

Defined in: shared/access/types.ts:152

effectiveEnd?Copy Anchor Link

optional effectiveEnd?: string | null;

Defined in: shared/access/types.ts:154

effectiveStart?Copy Anchor Link

optional effectiveStart?: string | null;

Defined in: shared/access/types.ts:153

grantIdCopy Anchor Link

grantId: string;

Defined in: shared/access/types.ts:141

permissionsCopy Anchor Link

permissions: `${string}.${string}`[];

Defined in: shared/access/types.ts:150

roleIdCopy Anchor Link

roleId: string;

Defined in: shared/access/types.ts:142

roleIdentifierCopy Anchor Link

roleIdentifier: string;

Defined in: shared/access/types.ts:143

scopeCopy Anchor Link

scope: GrantScope;

Defined in: shared/access/types.ts:149

The scope this grant was GRANTED IN — per row, never the scope of the check. An organization-scoped check carries platform rows here (see scopeChain); footing derivation and the decision trace both read it.

selector?Copy Anchor Link

optional selector?: ResourceSelector;

Defined in: shared/access/types.ts:151