Grants and scopes

A grant is the unit of consent. It names the recipient, the domains, the level per domain, the purpose in the recipient's own words, the expiry, and whether the recipient may keep a copy.

Scopes

A grant compiles to OAuth 2.1 scopes. autonym:read:dining:L1 allows reading dining at L1 or below. autonym:propose allows proposing entries into the review queue. autonym:confirm allows confirming a proposal on the person's spoken instruction. autonym:persist allows the recipient to keep entries until persist_until. autonym:manage is the person's own scope, never granted to a recipient.

Example: scope: autonym:read:dining:L1 autonym:read:accessibility:L1

Purpose

The purpose string is written by the recipient and shown to the person verbatim on the consent screen. It is stored on the grant and returned by get_grant. The interface never paraphrases it.

Delegation

An assistant holding a grant can obtain a narrower grant for a service on the person's behalf, for example a booking site that needs dining at L1 for one reservation. The delegated token carries the delegate's identity, is capped by the parent, and the person is notified.

Revocation

POST /v1/me/grants/{id}/revoke invalidates every token under the grant. If the recipient held autonym:persist, a purge instruction is sent and the recipient must acknowledge it. The recipient is told the grant ended, not why.