authz: confine a control-plane token to a catalog prefix - #3319

Draft

GregorShear wants to merge 3 commits into

Commits on Aug 5, 2026

authz: add AuthScope, a grant-graph ceiling on a subject's authority
GregorShear
committed
4452c7a
control-plane-api: route all authorization through a request-scoped Authority
GregorShear
committed
8259e50
authz: mint scope-confined credentials, and close the ways out of a scope
GregorShear
committed
f94cd7e