URL path on the supplied client where the engine should fetch
grants. The actor always token-resolves from the supplied client; without
a grants path the rendered $can is undefined, so conditions
referencing it fail closed — and the real Sanity write boundary
still enforces.
Result is cached per (client, path) for the lifetime of the
process — grants don't change often, and tearing them down per
call would mean a network round-trip on every fireAction.
URL path on the supplied client where the engine should fetch grants. The actor always token-resolves from the supplied client; without a grants path the rendered
$canis undefined, so conditions referencing it fail closed — and the real Sanity write boundary still enforces.Canvas resource example:
/canvases/<resourceId>/acl. Project/dataset example:/projects/<id>/datasets/<dataset>/acl.Result is cached per
(client, path)for the lifetime of the process — grants don't change often, and tearing them down per call would mean a network round-trip on every fireAction.