Effective permissions of a delegated agent: requested ∩ user ∩ parent, minus explicit denials

Overview

Computes what a sub-agent may actually do: the permissions it requested, intersected with what the end user holds and what its parent agent holds, minus any explicit deny list, and says for each denied permission which party lacks it. Permission names are compared exactly (no wildcards); caller-declared implications (for example 'admin' grants 'read') can be given and are expanded transitively with cycles tolerated. fail when any requested permission is not granted (privilege

Health