OptionalattributesOptional bag for callers that compose a WorkflowAccess by hand (the test bench). resolveAccess never populates this — soft-gate paths load attributes via resolveUserAttributes.
OptionalgrantsOptionallocalThe actor's principal id in the workflow resource's OWN identity
namespace — what that resource's lake identity() returns for the same
token (the per-project user id for dataset resources; equal to
Actor.id for org-level resources and robots). In-memory only,
never persisted: it exists for the lake-facing edge — binding
identity() in guard previews and grant-filter evaluation so the
advisory verdicts agree with what the lake itself would decide.
The engine's view of "who am I, what can I do?".
actoris who the engine stamps onto history /completedBy/ValueExpr.actor— token-resolved advisory provenance (see Actor).grants(when present) feed the advisory$can.*params action conditions can read; there is no engine-side permission verdict. When grants are absent the rendered$canis undefined — conditions referencing it fail closed, everything else is ungated engine-side — and the real Sanity write boundary takes over. See WorkflowAccess.attributes for the parallel$attributesbag.