{
  "handle": "Permission",
  "data_schema": {
    "type": "object",
    "required": [
      "permission_id",
      "agent_id",
      "action"
    ],
    "properties": {
      "permission_id": {
        "type": "string",
        "description": "Unique identifier for this permission"
      },
      "agent_id": {
        "type": "string",
        "description": "Who is granted permission"
      },
      "action": {
        "type": "string",
        "description": "What action is permitted"
      },
      "resource": {
        "type": "string",
        "description": "What artifact can be accessed"
      },
      "granted_at": {
        "type": "string",
        "format": "date-time",
        "description": "When permission was granted"
      }
    }
  },
  "mechanism": "An authorization grant allowing an {{agent}} to perform a specific {{act}} or access a {{artifact}}. The atomic unit of access control.",
  "gloss": "Authorization grant",
  "failure_modes": [
    "Privilege escalation: agent acquires permission beyond intended scope.",
    "Stale grant: permission remains active after it should have expired."
  ],
  "_meta": {
    "ring": 1,
    "tier": 1,
    "caution": "Authorization boundary — misconfigured grants enable unauthorized action.",
    "supersedes": [
      "sema:Permission#mh:SHA-256:7f7d69e56a0b6bd65577a7fd6e8602f5bb694a647b3493a55823de851a32676f",
      "sema:Permission#mh:SHA-256:4ee0362513125ffdfa6589c4848eb078ac9906acf26057520e000fc070c8cf6d",
      "sema:Permission#mh:SHA-256:f3470b4ff692d65cb74a12a52b69caffdf008e55e1ef0062a9927c6b72877005",
      "sema:Permission#mh:SHA-256:9c2fc31f5e31473c03834463095e4390750f7fda11f5a1aed2502f855a65dbcf"
    ],
    "path": [
      "Infrastructure",
      "Data Structures"
    ],
    "related": [
      "Consentrenew#9da5",
      "Mandatune#7d34"
    ]
  },
  "invariants": [
    "Authorises only what it names: the {{agent}}, and the {{act}} or {{artifact}} identified."
  ],
  "sema_id": "sema:Permission#mh:SHA-256:dd1d6ae125fa009be9d6fdbf2e036ba382ecf69407f780068cbde55318108b23",
  "sema_ref": "Permission#dd1d",
  "sema_stub": "dd1d",
  "dependencies": {
    "references": {
      "act": "sema:Act#mh:SHA-256:2dfedd75a396f2639ce949b9f5270766350b9c7404d404c11c57140fcf030455",
      "agent": "sema:Agent#mh:SHA-256:e127459069739fffc96a71d54ef6e8c97ca53471d5349c16aa72a092a33756cd",
      "artifact": "sema:Artifact#mh:SHA-256:b533ad2674ec00c5e9a5f1e3920f1097e2bc1eea7263f89e8f46563fa319a0ee"
    }
  },
  "sema_layer": "Infrastructure",
  "sema_category": "Data Structures",
  "used_by": {
    "references": {
      "ConfusedDeputy": "sema:ConfusedDeputy#mh:SHA-256:119aeab272e329eef56459a0d0fa7bcf46aab9b07dab2b3cf947034a63a5116f",
      "Consentrenew": "sema:Consentrenew#mh:SHA-256:9da5f8adc0ed8c9c40f7e9a9884f15ca3d71ee076a1f448f9df9309960332af5",
      "Mandatune": "sema:Mandatune#mh:SHA-256:7d34ae7d3f9b6c68f618a8090869c42d58cbe0e7596713ca54516a123446a004"
    }
  }
}