[ragnorc]

Summary

A draft RFC, docs/rfcs/2026-10-30-access-authority-views-and-capabilities.md (titled "Access authority: views and reach"; the filename is fixed by the registry convention), written from first principles for a contributor who has not read anything about permissions and has to judge whether this is the right design.

It decides between, and then combines, the two open permission drafts, #951 (actor views) and #1197 (GQP query contracts and Cedar grants), and then reduces the result to the fewest primitives that compose:

• A view: the data a request may see, derived from labels on rows and columns and the actor's memberships through a fixed algebra (@principal, @member, @securable, @in, @grant, @inherits, @requires, @deny, a time window), enforced as one filter at plan acceptance and as hidden names in the schema.
• One declaration, over, that a grant, a delegated credential or a stored query runs under a different view than the actor's own. over: all on a stored query, granted by name, is how a caller runs an approved computation over data it cannot see; over: all on a rule is bypass; a narrowing over is a caveat.

The rule behind it: an audience is a label on the data; a predicate that mentions the caller is a program.

The RFC states the goals (G1–G11) from five situations, surveys the design space against them, specifies the design by example, audits every primitive against G11, evaluates a 27-pattern expressiveness ledger, lists costs and alternatives, and ends with an implementation appendix for agents.

What it changes in the two drafts

• rfc: granular permissioning #951: denial closes downward over inheritance; @group is derived; the views policy block is replaced by a bridge row (policy:<name> as a subject), over on rules and cluster-configured limits; computed placement moves into the row-view phase; the default placement of inserts becomes explicit $subject; definer-rights stored queries become over on a stored query; Lance citations re-anchor to 13.0.0.
• rfc: query contracts and Cedar grants for agents #1197: per-name invoke_query and the fixed program as the unit of disclosure survive; the contract language, guard proofs, per-operator obligations, the single-binding fragment, trusted attributes, the submitted mode and the capability binding do not.

Both remain drafts; this RFC supersedes neither. Links to #951 point at its PR because its file is not on main yet.

Revision history

• First revision proposed a separate capability object with its own routes, configuration, contract language and error codes. The second revision removed it after an audit against G11; the decision log records what went and why.

Checks

• python3 scripts/check-docs.py: OK (438 files)
• typos: clean