Cascading permission model

A permission must never be just a boolean name.

Each grant should contain:

action
effect
resource_scope
use_allowed
delegate_allowed
delegate_to_key_types
maximum_delegation_depth
not_before
expires_at
audiences
rate_limit
total_use_limit
approval_requirement
required_signatures
conditions
Owner-set Primary Author policy

When an Owner mints a Primary Author, the policy has seven layers:

Layer 1: Self permissions

What the Primary Author may do directly.

Layer 2: Self resource scope

Which branches, namespaces, objects, recipients, and resources it may affect.

Layer 3: Child-type minting

Whether it may mint:

Additional Primary Authors.
Secondary Authors.
Use Keys.
Keyring Keys.
Layer 4: Child permission ceilings

The maximum permissions it may give each child type.

Layer 5: Child propagation ceilings

Which permissions those children may delegate onward.

Layer 6: Operational constraints
Expiration.
Maximum children.
Maximum depth.
Rate limits.
Audiences.
Environments.
Approval requirements.
Network conditions.
Required signature combinations.
Layer 7: Security responses

What the Key may:

Suspend.
Quarantine.
Rotate.
Revoke.
Report.
Freeze.