The default actor used when tests don't specify one. Its "*" role is an
inert placeholder, NOT a wildcard: role matching is literal membership, so
this actor satisfies no Action.roles gate or {kind: "role"} assignee on
its own — a test that exercises a role gate passes an actor carrying the
real role (and the definition's roleAliases decide what fulfills it). The
bench's all-access default is really WILDCARD_GRANTS, which feeds
$can. Production code should never see this id.
The default actor used when tests don't specify one. Its
"*"role is an inert placeholder, NOT a wildcard: role matching is literal membership, so this actor satisfies noAction.rolesgate or{kind: "role"}assignee on its own — a test that exercises a role gate passes an actor carrying the real role (and the definition'sroleAliasesdecide what fulfills it). The bench's all-access default is really WILDCARD_GRANTS, which feeds$can. Production code should never see this id.