Interface Grant

Filters are GROQ strings evaluated through groq-js with the document as the dataset and the caller's principal id as identity(). Grants compose most-permissive-wins.

interface Grant {
filter: string;
permissions: ("create" | "manage" | "read" | "update")[];
}