Each read-write access is composed with a grant: the module's containers that mount its path and the account its tools run as (the operator's, or the module's own under ADR 0259 §8); that runtime restarts on the access, so it holds a group the engine put its account in. A read access grants nothing. Sent only to an engine whose statement says GrantContract (4), since an older one refuses the field. Pins the node-engine at the branch that reads it.