# Access Grant

One permission: one principal, one resource, the allowed actions and the period. The only object that grants access.

An Access Grant is a permission issued by an authority. A business link, a seat, a membership or a tag never grants access. The table had no rows on 2026-10-28, so the base does not yet hold an audit of effective permissions.

## Rules and relationships

Link exactly one Principal and one Resource; a second principal or resource is a second grant. The pickers accept several records and nothing rejects them. Select every Action the authority confirms. Valid Through is a planned expiry; Revoked At records the actual removal and wins over any stale copy. Verified At is the last check against the authority. A grant reported by anyone other than the authority is a claim, not a permission.

## Fields

| Field | Storage | Current configuration |
| --- | --- | --- |
| Grant # | Auto number | Running number of the grant |
| Principal | Linked records | [Access Principal](/systems/tooling/entity-access-principal); Multiple-record picker |
| Resource | Linked records | [Resource](/systems/tooling/entity-resource); Multiple-record picker |
| Action | Multiple select | read, comment, write, create, delete, invite, admin, owner, billing |
| Authority | Text | Authority that issued and can revoke the grant |
| Valid From | Date and time | UTC; when the authority issued it |
| Valid Through | Date and time | UTC; planned expiry; blank = open-ended |
| Revoked At | Date and time | UTC; actual removal; wins over stale copies |
| Verified At | Date and time | UTC; last check against the authority |
| Source Role | Text | The tool's role label when recorded; Action is the effective permission |
| Tags | Linked records | [Tags (mirror)](/systems/tooling/entity-tags); Multiple-record picker |

## Example

Principal = 8f3a1c2e-user; Resource = C01ABCD2EFG; Action = read, write; Authority = Google Workspace; Valid From = 2026-03-01 09:00; Verified At = 2026-09-14 08:00.

## Next steps

[Record plans, seats and grants](/systems/tooling/record-access) · [Find the view](/systems/tooling/data-views)