Grants - Naïve

All three grant operations answer 501 not_configured in this build. There is no grants table. This page documents what a grant is and what the surface will report, so that you do not build a permission model around an object that does not exist yet.

GET  /v1/grants            → 501
GET  /v1/grants/{id}       → 501
POST /v1/grants/{id}/revoke → 501

501

{
  "error": {
    "code": "not_configured",
    "message": "Grants are not available in this build.",
    "details": {
      "surface": "governance",
      "missing": [
        "grant storage: no grants table exists. A Grant's five required properties (argument-bound `args_hash`, `single_use`, `redeemed_at`, `until`, `snapshot_digest`) each need a column, and a grant surface that cannot report them cannot be falsified by anyone."
      ]
    }
  }
}

What a grant is

A grant is a narrow, checkable permission to do one specific thing once. It is not a role and not a scope. Its five properties are five separate fields precisely so that each can be falsified:

Property	Field	Why it is separate
Argument-bound	`args_hash`	The grant covers these arguments. Approving a $240 transfer does not authorise a$ 2,400 one.
Single use	`single_use`	A grant that can be replayed is a standing permission wearing a narrow name.
Redeemed	`redeemed_at`	You can tell “not yet used” from “used”.
Time-boxed	`until`	Bounded by the `grant.maxUntil` ceiling reported by `GET /v1/limits`.
Snapshot-pinned	`snapshot_digest`	The grant is bound to the policy that was in force when it was issued, so a later policy change cannot silently widen it.

A surface that reports a grant without all five cannot be audited — which is why this one refuses rather than serving a partial object.

What happens instead today

Approving an item on the approvals queue replays the frozen payload captured when the approval was created. That gives you argument binding and single use in practice, but it is not a grant object: it has no until, no snapshot_digest, and no id you can revoke independently. POST …/approvals/{id}/decide reports this directly:

{
  "grant": null,
  "grant_unavailable_because": "grants have no storage in this build; this approval replays the frozen payload rather than minting an argument-bound, snapshot-pinned grant"
}

Revocation today

There is no grant to revoke. What you can do:

Revoke the agent profile — this stops its writes immediately. Note that reads keep answering, so rotate the key too.
Deny the pending approval with POST …/approvals/{id}/decide.
Disable the primitive on the AccountKit.

POST /v1/policy/break-glass — also 501, because break-glass mints a time-boxed grant
GET /v1/limits — reports grant.maxUntil: null, the ceiling that is not configured

​What a grant is

​What happens instead today

​Revocation today

​Related

What a grant is

What happens instead today

Revocation today

Related