Reference

Authorization model

Single path for all transports:

AuthorizationContext + SessionAction + SessionSecurityContext
        ↓
DefaultSessionAuthorizer
        ↓
AuthorizationDecision { allowed, reason_code, matched_grant_id, effective_permissions }

Decision order

Unknown client → deny.
Actor is session owner → allow with owner permissions.
Union active grants matching principal (client_id or client_instance_id).
Required permission for the action present → allow (grant_matched).
Else deny (missing_permission, grant_revoked, grant_expired, or session_not_found_or_not_visible for private discovery).

Session actions → permissions

Action	Permission
discover / list visibility	`discover`
get / metadata	`read_metadata`
events / replay	`read_events`
attach	`attach_read_only`
write	`write_input`
resize	`resize`
interrupt	`interrupt`
terminate	`terminate`
close	`close`
grant / revoke	`manage_grants`

Inspection

session/permissions — effective view for the caller
session/can — dry-run one action

Race rule

Authorization uses persisted grant revision at operation time:

either the control op is authorized before revoke commits, or
it is denied after revoke commits

Never partial authorization.