jschoubben
e163aab3d1
The grants part composes a subscribe deny where a node's tool runner does not honour the approval mark; the user list must carry it to the bus, and an added deny is a narrowing the user-list guard lets pass as no right lost. Builds: design 46 7 §6 (Permissions.SubscribeDeny, User subscribe_deny, comparison and differences, the guard's narrowing) Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h