{
  "schema_version": "0.1.0",
  "catalogue_status": "discovery_inventory",
  "authority": "Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.",
  "category": "authorization_policies_delegation",
  "description": "Grant structure, policy layers, inheritance constraints, evaluation rules, and versioning.",
  "items": [
    {
      "id": "auth.grant",
      "name": "Structured permission grant",
      "kind": "authorization_component",
      "description": "Permission is not merely a boolean; each grant carries effect, scope, delegation, temporal, audience, limits, approvals, signatures, and conditions.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/Cascading_Permissions_Model.txt",
          "lines": "1-21"
        }
      ],
      "fields": [
        "action",
        "effect",
        "resource_scope",
        "use_allowed",
        "delegate_allowed",
        "delegate_to_key_types",
        "maximum_delegation_depth",
        "not_before",
        "expires_at",
        "audiences",
        "rate_limit",
        "total_use_limit",
        "approval_requirement",
        "required_signatures",
        "conditions"
      ]
    },
    {
      "id": "auth.primary_policy",
      "name": "Seven-layer Primary Author policy",
      "kind": "policy_model",
      "description": "Owner-set policy combines self authority/scope, minting, child and propagation ceilings, operational constraints, and security responses.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Cascading_Permissions_Model.txt",
          "lines": "22-69"
        }
      ],
      "layers": [
        "Self permissions",
        "Self resource scope",
        "Child-type minting",
        "Child permission ceilings",
        "Child propagation ceilings",
        "Operational constraints",
        "Security responses"
      ]
    },
    {
      "id": "auth.invariants",
      "name": "Authorization invariants",
      "kind": "authorization_rules",
      "description": "Source explicitly labels these hard-coded invariants rather than configurable preferences.",
      "modality": "explicit_immutable",
      "sources": [
        {
          "file": "docs/seed/Authorization_Invariants.txt",
          "lines": "1-24"
        }
      ],
      "rules": [
        "Deny by default",
        "Explicit deny overrides allow",
        "Child self permissions subset of parent child ceiling",
        "Child delegation permissions subset of parent propagation ceiling",
        "Child resource scope no broader than parent",
        "Child expiry bounded by parent expiry/child TTL ceiling",
        "Child cannot increase delegation depth",
        "Child cannot remove inherited approval",
        "Child cannot weaken signature strength",
        "Revoked ancestor invalidates descendants",
        "Suspended ancestor temporarily suspends descendants",
        "Rotation preserves historical verification",
        "Revocation blocks new actions without rewriting provenance",
        "API Keys cannot modify Owner password/email/sessions/billing/recovery",
        "Provisioning source never affects authorization",
        "Credential ID/public key possession grants no permission",
        "Keyring membership grants no contained-Key authority",
        "Key cannot grant what it cannot delegate",
        "Expansion creates new policy version and event",
        "Events/signatures cannot be edited in place"
      ]
    },
    {
      "id": "auth.policy_versions",
      "name": "Immutable policy versions",
      "kind": "persistence_rule",
      "description": "Policy changes create new immutable versions with hashes and events.",
      "modality": "explicit_immutable",
      "sources": [
        {
          "file": "docs/seed/Minimum_Database_Model.txt",
          "lines": "62-73"
        },
        {
          "file": "docs/seed/Authorization_Invariants.txt",
          "lines": "23"
        }
      ]
    }
  ]
}