ak.schema.grant_constraint.v1

Arkret Grant Constraint

ak.schema.grant_constraint.v1 · file: schemas/grant-constraint.schema.json

* $ · object

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

allOf · allOf[5] · ?

allOf · allOf[6] · ?

allOf · allOf[7] · ?

allOf · allOf[8] · ?

allOf · allOf[9] · ?

allOf · allOf[10] · ?

allOf · allOf[11] · ?

allOf · allOf[12] · ?

allOf · allOf[13] · ?

allOf · allOf[14] · ?

constraint_id · string

Optional stable identifier of this constraint within the grant; used for diagnostics and overrides.

pattern: ^(?!ak:)

* constraint_kind · string (enum)

Constraint family discriminator. v1 collapses what were 15 types into 8 by absorbing narrowly-scoped types into their conceptual parent: edit_window â†’ temporal; container_move â†’ scope_limitation; rate_limiting + resource_limit â†’ quota; approval_workflow + accountability + device_session â†’ claim_based (with constraint_subkind); encryption_requirement + visibility_control â†’ confidentiality (with constraint_subkind). Use the optional 'constraint_subkind' field to indicate the original specialization where evaluation logic differs.

enum: "temporal" "field_access" "kind_restriction" "scope_limitation" "authority_control" "quota" "claim_based" "confidentiality"

* effect · string (enum)

enum: "allow" "deny" "quarantine" "require_review"

evaluation_class · string (enum)

Cacheability/dependency hint for the authorization evaluator. stateless = pure function of (constraint, op, now); grant_local = depends on the grant object only; realm_state = depends on the exact Realm authority revision (membership, policy_version, etc.); external = depends on data outside that authority state (claim revocation status, rate-limit counts, async approval). Each constraint_kind has a canonical evaluation_class declared in constraint-schema.md Â§2.3; implementations MAY tighten (e.g. grant_local â†’ stateless) but MUST NOT loosen (e.g. external as stateless). Auth evaluators SHOULD use this hint to gate fast-path caching.

enum: "stateless" "grant_local" "realm_state" "external"

constraint_subkind · string (enum)

Optional discriminator within a constraint_kind. Standard values: claim_based.{claim,approval,accountability}; quota.{rate,resource}; confidentiality.{encryption,visibility}; temporal.{window,edit_window,redact_window,session}; authority_control.{applet_authority}. Per constraint-schema.md Â§2.2, device/session binding is NOT an independent constraint_subkind: it is the claim_based constraint_subkind=claim sub-case expressed via an accepted PCR device issuer. Implementations MAY require constraint_subkind for these families and fail closed on unknown values.

enum: "claim" "approval" "accountability" "rate" "resource" "encryption" "visibility" "window" "edit_window" "redact_window" "session" "applet_authority"

applies_to_actions · array<string>

Optional restriction of a temporal constraint to specific capability actions (e.g. ['ak.message.revise.own', 'ak.message.redact.own']). Action mismatch is neutral in the effect fold: satisfied for effect=allow and not matched for deny/quarantine/require_review.

items · string

pattern: ^ak\.[a-z0-9_]+(\.[a-z0-9_]+)*$

not_before · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

recurrence · object

Recurrence rule for temporal constraints. Used by constraint-schema.md Â§3.1.

frequency · string (enum)

enum: "daily" "weekly" "monthly" "custom"

days · array<string (enum)>

items · string (enum)

enum: "mon" "tue" "wed" "thu" "fri" "sat" "sun"

window_start · string

pattern: ^([01][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9])?$

window_end · string

pattern: ^([01][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9])?$

timezone · string

max_duration · string

ISO 8601 duration.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

max_session_duration · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

inactivity_timeout · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

expires_after · string

ISO 8601 duration; used by approval_workflow constraint instead of expires_after_ms.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

message_edit_window · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

message_redact_window · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

redact_after_window_allowed · boolean

condition · object

Conditional predicate for field_access and similar constraints. The `kind` value is a registered named condition from constraint-schema.md Â§4.1; unknown kinds MUST fail closed. Implementations MUST NOT introduce ad hoc string DSL predicates.

* kind · string (enum)

enum: "object_is_owned_by_actor" "actor_is_assignee" "actor_is_responsible" "actor_is_guardian" "actor_is_controller" "object_in_actor_container" "object_is_unencrypted" "object_is_encrypted" "always" "never"

allowed_write_fields · array<string>

items · string

denied_write_fields · array<string>

items · string

allowed_read_fields · array<string>

items · string

denied_read_fields · array<string>

items · string

sensitive_fields · array<string>

items · string

sensitive_handling · string (enum)

enum: "redact" "hash" "omit"

allowed_object_kinds · array<string>

items · string

denied_object_kinds · array<string>

items · string

allowed_morph_kinds · array<string>

items · string

denied_morph_kinds · array<string>

items · string

allowed_space_kinds · array<string>

Allowed Space kinds (e.g. 'board', 'list', or profile-registered kinds like 'swimlane', 'calendar_bucket'). Reducer/profile MUST validate kind value.

items · string

denied_space_kinds · array<string>

items · string

allowed_facets · array<string (enum)>

items · string (enum)

enum: "container" "replyable" "schedulable" "assignable" "stateful" "rankable" "reviewable" "notifiable" "documentable" "renderable"

denied_facets · array<string (enum)>

items · string (enum)

enum: "container" "replyable" "schedulable" "assignable" "stateful" "rankable" "reviewable" "notifiable" "documentable" "renderable"

allowed_view_ids · array<string>

items · string

pattern: ^ak:view:[A-Za-z0-9_-]{44}$

allowed_strand_ids · array<string>

items · string

pattern: ^ak:strand:[A-Za-z0-9_-]{44}$

denied_strand_ids · array<string>

items · string

pattern: ^ak:strand:[A-Za-z0-9_-]{44}$

allowed_space_ids · array<string>

items · string

pattern: ^ak:space:[A-Za-z0-9_-]{44}$

denied_space_ids · array<string>

items · string

pattern: ^ak:space:[A-Za-z0-9_-]{44}$

allowed_circle_ids · array<$ref ./common-ids.schema.json#/$defs/circle_id>

Limits Circle-scoped capability actions to the listed Circle ids. Used by ak.circle.manage / ak.circle.member.manage style grants; unconstrained Realm-wide Circle management grants are not a normal permission shape.

items · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

allowed_session_ids · array<string>

Limits applet interop-session operations to the listed applet-defined session correlation ids.

items · string

pattern: ^(?!ak:)

allowed_view_kinds · array<string>

items · string

allowed_view_renderers · array<string>

items · string

denied_view_kinds · array<string>

items · string

denied_view_renderers · array<string>

items · string

allowed_relation_kinds · array<string>

items · string

allowed_from_container_refs · array<string>

items · string

pattern: ^ak:(space|strand|morph):[A-Za-z0-9_-]{44}$

allowed_to_container_refs · array<string>

items · string

pattern: ^ak:(space|strand|morph):[A-Za-z0-9_-]{44}$

wip_limit_override · boolean

example: false

allowed_tracks · array<string>

items · string

pattern: ^[a-z][a-z0-9_]{0,63}$

denied_tracks · array<string>

items · string

pattern: ^[a-z][a-z0-9_]{0,63}$

blob_presign_scope · object

Scope limiter for ak.self.blob.command.presign.v1 grants: allowed purposes plus optional blob/realm restrictions.

* allowed_purposes · array<string (enum)>

items · string (enum)

enum: "media_inline" "thumbnail" "download"

blob_ref_pattern · string

realm_ids · array<$ref ./common-ids.schema.json#/$defs/realm_id>

items · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

allowed_data_labels · array<string>

Data classification labels this grant may read, export, transform, or send to external endpoints.

items · string

pattern: ^[a-z][a-z0-9_]{0,63}$

allowed_endpoints · array<string>

Allowed outbound endpoint origins or deployment-approved endpoint patterns for applet / agent / connector operations.

items · string

max_authority_depth · integer

Maximum remaining authority hops. Bounded by the canonical authority-chain depth ceiling (4) defined in zh/conformance/scalability-constraints.md Â§3 and zh/authz/capabilities.md Â§10.2; reducers MUST reject grants declaring a larger value at accept time rather than only truncating during DFS.

authority_path_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

authority_regrant_allowed · boolean

authority_scope · string (enum)

enum: "narrowing_only" "same_scope" "custom"

applet_id · string · $ref ./common-ids.schema.json#/$defs/applet_id

Stable canonical Applet installation identity. Applet service authority is carried separately by service_id.

pattern: ^ak:applet:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

executed_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

registration_epoch · string

authority_control(constraint_subkind=applet_authority) binding to the canonical Applet registration epoch.

pattern: ^sha256:[0-9a-f]{64}$

blob_max_bytes · integer

blob_presign_max_ttl_seconds · integer

Maximum TTL, in seconds, that this grant permits for ak.blob.presign. The service must clamp requested max_age_seconds to the smaller of this value and deployment policy.

max_total_blob_bytes · integer

max_artifact_bytes · integer

Maximum artifact size in bytes for applet / agent / export operations.

max_operations · integer

Maximum number of distinct accepted idempotency identities in one UTC epoch-aligned fixed period. Enforcement is a linearizable check-and-reserve at one logical quota authority shared by every node in the enforcing service; per-node duplicated budgets and overshoot are forbidden.

period · string

ISO 8601 duration. For quota constraints, a stricter conditional schema permits only a non-zero fixed-length week/day/hour/minute/second duration; year/month durations are forbidden so every authority derives the same UTC epoch-aligned window id.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

burst · integer

Optional token-bucket capacity at the same logical quota authority, capped by max_operations and refilled at max_operations/period. It never increases the fixed-window total budget.

constraint_scope · string (enum)

Closed v1 quota counting scope. Unknown values are schema violations and MUST fail closed. Quota counters are actor-bound; the enum selects the additional slicing dimension: actor only, actor+space, actor+realm, or actor across all nodes/regions of the enforcing service's global quota domain. global is not an implicit federation-wide counter. Every node in the service domain MUST share one logical linearizable quota authority.

enum: "per_actor" "per_space" "per_realm" "global"

max_resources · integer

resource_kind · string

approval_required · boolean

approval_mode · string (enum)

The only approval mode of v1. The approved write MUST NOT take effect before the approval evidence is verified and accepted in the same transaction (zh/authz/constraint-schema.md section 9.2.7). There is no second mode and no path that first materializes a proposal object and then approves that object.

enum: "before_commit"

approval_actor_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

approval_relation · string (enum)

Responsibility classification of this grant explicit approval_actor_ids roster. It never creates a second dynamic roster or supplies action/scope capability. Missing explicit roster cannot satisfy approval.

enum: "responsible" "controller" "guardian" "realm_admin" "custom"

timeout · string

Positive fixed ISO 8601 duration (week/day/hour/minute/second, no calendar year/month). Each approval vote is valid only when the target covering committed_at <= that vote input.approved_at + timeout, inclusive and with zero tolerance. The same rule applies to Event and operation targets; receiver clocks and first-seen timestamps never anchor it. Omission adds no grant-local age limit.

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

approval_threshold · oneOf[2]

Closed executable vote threshold: majority means floor(N/2)+1, unanimous means N, and a positive integer is the exact quorum. N is the distinct eligible approver set at the accepting authority cut. Omission means unanimous. A missing or empty eligible set, or an integer greater than N, cannot satisfy approval. Repeated signatures by one approver count once. Parameterless quorum/custom strings are schema violations.

example: "unanimous"

oneOf · oneOf[0] · string (enum)

enum: "majority" "unanimous"

oneOf · oneOf[1] · integer

accountability_required · boolean

guardian_approval_required · boolean

controller_approval_required · boolean

required_claims · array<object>

Conditional claim requirements. resource-selector-grammar.md Â§3.3 caps this array at 32 entries as a normative DoS guard; the schema enforces maxItems:32 so condition-selector grants cannot smuggle in unbounded claim objects.

items · object

anyOf · anyOf[0] · ?

anyOf · anyOf[1] · ?

* claim_kind · string

issuer_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

trusted_issuer_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

subject_matches_actor · boolean

If true, the credential subject did_core_id MUST match the actor did_core_id after each proof's DID is independently validated and projected through its registered method adapter.

example: true

value_constraints · object

Per-field equality / membership constraints on credential claims.

organization_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

status · string

roles · array<string>

items · string

trusted_claim_issuer_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

claim_refresh_required · boolean

claim_max_age · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

allowed_history_access_values · array<string (enum)>

items · string (enum)

enum: "since_join" "all_history_for_current_members"

redacted_history_allowed · boolean

encryption_required · boolean

min_encryption_level · string (enum)

confidentiality(constraint_subkind=encryption) static floor: the minimum content-encryption mechanism the grant requires. Pure static declaration evaluated as stateless unless cross-checked against the scope's current MLS activation state (see constraint-schema.md section 12).

enum: "none" "mls_rfc9420" "external"

plaintext_fallback_allowed · boolean

confidentiality(constraint_subkind=encryption) static flag: whether the grant permits plaintext in a scope that has no accepted ak.mls.genesis. After activation the flag cannot restore plaintext; the write MUST be rejected with mls_activation_irreversible. See constraint-schema.md Â§12.

audit_trail_required · boolean

confidentiality(constraint_subkind=encryption) static flag: whether the grant requires an audit trail (e.g. active Audit Applet Binding). See constraint-schema.md Â§12.

key_rotation_period · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

max_key_age · string

pattern: ^P(?:[0-9]+Y)?(?:[0-9]+M)?(?:[0-9]+W)?(?:[0-9]+D)?(?:T(?:[0-9]+H)?(?:[0-9]+M)?(?:[0-9]+S)?)?$

key_backup_required · boolean

approved_key_issuer_ids · array<$ref ./common-ids.schema.json#/$defs/did_core_id>

items · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

depends_on_moderation_state · boolean

Cache-invalidation hint: when true, this grant's authorization decisions depend on the moderation_state typed current result (see capabilities.md Â§18.1) and the grant's cache entry MUST be invalidated when that typed current result changes. Default false: ordinary grants (ak.strand.update / ak.message.create / organization membership grants) do NOT take a cache hit on every moderation decision. v1 capabilities.md Â§18.1 lists three conditions where MUST be explicitly true (moderator-role grants, condition-selector subjects referencing moderation state, constraints referencing moderation queue / typed current result). Schema-side enforcement of condition (2) is in capability-grant.schema.json via if/then on actions[]; conditions (1) and (3) are reducer-side lint. Cache invalidation hint outside the eight constraint families; it does not participate in allow/deny evaluation and is documented in capabilities.md Â§6 / constraint-schema.md.

allowed_managed_actor_roles · array<string (enum)>

Ordinary authority_control permits only these accepted roles of the Applet bound by the parent applet_authority constraint; no arbitrary third-party regrant.

items · string (enum)

enum: "bot" "ghost"

(^x_[a-z][a-z0-9_]{0,63}$) · any

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/grant-constraint.schema.json