Access Grant
One permission: one principal, one resource, the allowed actions and the period. The only object that grants access.
An Access Grant is a permission issued by an authority. A business link, a seat, a membership or a tag never grants access. The table had no rows on 2026-10-28, so the base does not yet hold an audit of effective permissions.
Rules and relationships
Link exactly one Principal and one Resource; a second principal or resource is a second grant. The pickers accept several records and nothing rejects them. Select every Action the authority confirms. Valid Through is a planned expiry; Revoked At records the actual removal and wins over any stale copy. Verified At is the last check against the authority. A grant reported by anyone other than the authority is a claim, not a permission.
Fields
| Field | Storage | Current configuration |
|---|---|---|
| Grant # | Auto number | Running number of the grant |
| Principal | Linked records | Access Principal; Multiple-record picker |
| Resource | Linked records | Resource; Multiple-record picker |
| Action | Multiple select | read, comment, write, create, delete, invite, admin, owner, billing |
| Authority | Text | Authority that issued and can revoke the grant |
| Valid From | Date and time | UTC; when the authority issued it |
| Valid Through | Date and time | UTC; planned expiry; blank = open-ended |
| Revoked At | Date and time | UTC; actual removal; wins over stale copies |
| Verified At | Date and time | UTC; last check against the authority |
| Source Role | Text | The tool’s role label when recorded; Action is the effective permission |
| Tags | Linked records | Tags (mirror); Multiple-record picker |
Example
Principal = 8f3a1c2e-user; Resource = C01ABCD2EFG; Action = read, write; Authority = Google Workspace; Valid From = 2026-03-01 09:00; Verified At = 2026-09-14 08:00.