@sixb/core 0.1.17 → 0.1.18

package/src/execution/scopes.ts

@@ -146,12 +146,8 @@ export function createTestingScope(input: {
 }
 
 function withoutSession(context: AuthorizationContext): AuthorizationContext {
-  return {
-    principal: context.principal,
-    groupIds: context.groupIds,
-    roleIds: context.roleIds,
-    grants: context.grants,
-  }
+  const { sessionId: _sessionId, ...withoutSessionId } = context
+  return withoutSessionId
 }
 
 function createRequestExecution(input: {

package/src/http/api-routes.ts

@@ -34,7 +34,8 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
   // Token and service-account management is bearer-capable so the CLI can authenticate with a
   // personal access token. It is NOT exposed to agents. The runtime still confines every operation
   // to the caller's own groups, and service-account tokens are rejected (only user principals may
-  // manage credentials).
+  // manage credentials). Creating a token is the exception: it takes a signed-in session, so no
+  // access token can mint one broader or longer-lived than itself.
   {
     operationId: "getAuthAccessManagementOptions",
     method: "GET",
@@ -53,7 +54,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     operationId: "createAuthPersonalAccessToken",
     method: "POST",
     path: "/api/auth/access-tokens",
-    accessToken: true,
+    accessToken: false,
     agentApi: false,
   },
   {
@@ -95,7 +96,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     operationId: "createAuthServiceAccountAccessToken",
     method: "POST",
     path: "/api/auth/service-accounts/:serviceAccountId/access-tokens",
-    accessToken: true,
+    accessToken: false,
     agentApi: false,
   },
   {

package/src/index.ts

@@ -64,6 +64,7 @@ export {
   userRef,
   valueTypeRef,
 } from "./ontology"
+export type { OntologyDoc, OntologyDocsCatalog, OntologyDocsInput } from "./ontology/docs"
 
 // ── Actions ─────────────────────────────────────────────────
 
@@ -220,6 +221,7 @@ export {
 
 export type {
   InferObjectProperties,
+  InferObjectReadProperties,
   InferPropertySemanticType,
   InferPropertyUnit,
   InferPropertyValue,
@@ -464,6 +466,7 @@ export type {
   BreadthSelector,
   BreadthTarget,
   DefineGroupOptions,
+  DefineMarkingOptions,
   DefineMembershipPolicyOptions,
   DefineRoleOptions,
   EditGrant,
@@ -473,10 +476,13 @@ export type {
   GroupReference,
   ManageGrant,
   ManageGrantTarget,
+  MarkingDefinition,
   MembershipOperation,
   MembershipPolicyDefinition,
   ObserveGrant,
   ObserveGrantTarget,
+  RedactionReason,
+  Redactions,
   RegisteredSecurityDefinitions,
   RoleDefinition,
   RunGrant,
@@ -491,6 +497,7 @@ export {
   applications,
   can,
   defineGroup,
+  defineMarking,
   defineMembershipPolicy,
   defineRole,
   every,
@@ -563,6 +570,7 @@ export type {
   BlobInfo,
   BlobStorage,
   FileRef,
+  OpenedFileRef,
 } from "./blob-storage"
 export {
   DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
@@ -579,6 +587,7 @@ export {
 export type {
   DatasetProducer,
   DatasetRow,
+  DatasetVersion,
   LakeStorage,
   LakeStorageWithSql,
 } from "./lake-storage"
@@ -892,7 +901,13 @@ export type {
 export type { CreateFileDownloadUrlOptions, FileDownloadUrl } from "./blob-storage/download-urls"
 export type { BlobsRuntime } from "./blob-storage/execution"
 export type { ConnectorRuntime } from "./connectors/execution"
-export type { DatasetIngestInput, DatasetIngestResult, DatasetsRuntime } from "./datasets/execution"
+export type {
+  DatasetIngestInput,
+  DatasetIngestResult,
+  DatasetReadRowsInput,
+  DatasetRows,
+  DatasetsRuntime,
+} from "./datasets/execution"
 export type {
   SixbActionPhaseFailedContext,
   SixbErrorContext,
@@ -943,12 +958,15 @@ export type {
   BatchItemResult,
   CreateSixbOptions,
   DefinitionCatalog,
+  FileListPropertyToken,
+  FilePropertyToken,
   ListResult,
   ListResultWithoutTotal,
   ObjectByIdHandle,
   ObjectExpandBuilder,
   ObjectExpandOptions,
   ObjectExpansionSort,
+  ObjectFileHandle,
   ObjectQueryBuilder,
   ObjectQueryFacetBucket,
   ObjectQueryFacetInput,
@@ -1025,6 +1043,9 @@ export type {
   AgentContextInput,
   AgentContextOrigin,
   AgentContextPart,
+  AgentContinuationPart,
+  AgentDefinitions,
+  AgentDefinitionsInput,
   AgentDescriptor,
   AgentFileDataProjection,
   AgentFileDataResolverInput,
@@ -1033,17 +1054,20 @@ export type {
   AgentMessagePart,
   AgentMessagePartType,
   AgentMessageRole,
+  AgentProjectFile,
   AgentProviderStatePart,
   AgentReasoning,
-  AgentReasoningLevel,
   AgentReasoningPart,
   AgentReference,
   AgentRequestErrorCode,
+  AgentSkillCatalog,
+  AgentSkillDefinition,
   AgentStepStartPart,
   AgentTextPart,
   AgentToolArtifact,
   AgentToolArtifactPutInput,
   AgentToolArtifacts,
+  AgentToolAttachments,
   AgentToolCallPart,
   AgentToolCallState,
   AgentToolCatalog,
@@ -1060,6 +1084,7 @@ export type {
   AgentToolRunBuilder,
   AgentToolRunContext,
   AgentToolRunInfo,
+  AgentToolRuntimeFacade,
   AgentToolTextContent,
   AgentUsageReference,
   InferAgentToolInput,

package/src/models/catalog.ts

@@ -13,7 +13,11 @@ import {
   type ModelDefinition,
 } from "./definitions"
 import { assertEmbeddingModel, type EmbeddingModel } from "./embedding-model"
-import type { LanguageModel } from "./language-model"
+import {
+  type LanguageModel,
+  MODEL_REASONING_LEVELS,
+  modelReasoningSupportIssue,
+} from "./language-model"
 import { assertRerankingModel, type RerankingModel } from "./reranking-model"
 
 /** Stable identity of a configured provider binding. */
@@ -143,7 +147,10 @@ function createLanguageCatalog(
     throw new RuntimeError("[Sixb] 'models.language' must be an array of Sixb language models.")
   }
 
-  const index = indexModelBindings(models, "language", assertLanguageModel)
+  const index = indexModelBindings(models, "language", (model, position) => {
+    assertLanguageModel(model, position)
+    assertDefaultReasoning(model, position)
+  })
   const [defaultEntry] = index.list()
   if (!defaultEntry) {
     throw new RuntimeError(
@@ -164,6 +171,23 @@ function createEmbeddingCatalog(
   return indexModelBindings(models ?? [], "embedding", assertEmbeddingModel)
 }
 
+// Capabilities known without catalog I/O. Unknown support is accepted: providers fall back to their
+// default when a resolved model turns out not to support the level.
+function assertDefaultReasoning(model: LanguageModel, index: number): void {
+  const reasoning: unknown = model.defaultReasoning
+  if (reasoning === undefined) return
+  if (!(MODEL_REASONING_LEVELS as readonly unknown[]).includes(reasoning)) {
+    throw invalidLanguageModel(
+      index,
+      `expected 'defaultReasoning' to be one of: ${MODEL_REASONING_LEVELS.join(", ")}`
+    )
+  }
+  const issue = modelReasoningSupportIssue(model.definition.capabilities.reasoning, reasoning)
+  if (issue !== undefined) {
+    throw invalidLanguageModel(index, `default reasoning '${reasoning}' cannot be used: ${issue}`)
+  }
+}
+
 function assertLanguageModel(model: unknown, index: number): asserts model is LanguageModel {
   if ((typeof model !== "object" && typeof model !== "function") || model === null) {
     throw invalidLanguageModel(index, "expected a Sixb LanguageModel instance")

package/src/models/execution/README.md

@@ -43,9 +43,10 @@ unknown input usage and unresolved capacity. Inference is never retried here.
 replays accounting only, never inference; see the
 [worker recovery contract](../../../../agent-worker/docs/usage-accounting.md).
 
-Direct provider calls bypass this session. Webhook handlers have no bound model execution attempt;
-they must dispatch an action for accounted calls. A process crash before accounting is captured
-can still leave provider billing outside the ledger.
+An Agent run binds its own recorder to its SDK, so calls from its tools share the run's admission,
+failure state and cancellation. Direct provider calls bypass this session. Webhook handlers have no
+bound model execution attempt; they must dispatch an action for accounted calls. A process crash
+before accounting is captured can still leave provider billing outside the ledger.
 
 ## Reranking flow
 

package/src/models/execution/binding.ts

@@ -1,10 +1,16 @@
 import type { ModelsRuntime } from "../generation-types"
+import type { AiModelCallRecorder } from "./model-call-recorder"
 
 export interface ModelExecutionAttempt {
   readonly attempt: number
   readonly signal: AbortSignal
   /** Internal durable fence around admission; it must invoke admit exactly once to proceed. */
   readonly embeddingAdmission?: (admit: () => Promise<void>) => Promise<void>
+  /**
+   * Accounting the execution attempt already owns, such as an Agent run's. Calls then share its
+   * admission and failure state instead of opening a second recorder for the same attempt.
+   */
+  readonly accounting?: AiModelCallRecorder
 }
 
 const bindings = new WeakMap<ModelsRuntime, (input: ModelExecutionAttempt) => void>()

package/src/models/execution/model-call-recorder.ts

@@ -70,6 +70,16 @@ export class AiModelCallRecorder {
       })
   }
 
+  /** The execution every call this recorder admits is attributed to. */
+  get executionId(): string {
+    return this.input.executionId
+  }
+
+  /** The execution attempt every call this recorder admits is attributed to. */
+  get attempt(): number {
+    return this.input.attempt
+  }
+
   /** Wrap the resolved model so all calls in an execution share admission. */
   wrapModel(model: LanguageModel): LanguageModel {
     return {

package/src/models/execution/session.ts

@@ -34,8 +34,8 @@ export class ModelExecutionSession {
   }
 
   accounting(): Promise<AiModelCallRecorder> {
-    this.requireBinding()
-    this.recorder ??= this.createRecorder()
+    const { accounting } = this.requireBinding()
+    this.recorder ??= accounting ? Promise.resolve(accounting) : this.createRecorder()
     return this.recorder
   }
 

package/src/models/execution.ts

@@ -45,6 +45,7 @@ export function createModelsRuntime(
     const messages = generationMessages(input)
     const signal = session.signal(input.signal)
     signal.throwIfAborted()
+    // The catalog's binding is the configured one, default reasoning included.
     const selected = input.model
       ? catalog
         ? catalog.language?.getByRef({
@@ -70,6 +71,9 @@ export function createModelsRuntime(
       input.reasoning
     )
     if (reasoningIssue) throw new UnsupportedModelFeatureError(`[SixbModels] ${reasoningIssue}.`)
+    // The default was checked against the capabilities known at startup; like any request, a level
+    // the resolved model turns out not to support falls back to the provider default.
+    const reasoning = input.reasoning ?? selected.defaultReasoning
     if (output && model.definition.capabilities.nativeStructuredOutput === false) {
       throw new UnsupportedModelFeatureError(
         "[SixbModels] Model does not support native structured output."
@@ -79,7 +83,7 @@ export function createModelsRuntime(
       aiModelCallOutputTokenAllowance(input.maxOutputTokens ?? model.definition.maxOutputTokens),
       model.definition.maxOutputTokens ?? Infinity
     )
-    if (typeof input.reasoning === "object" && input.reasoning.budgetTokens >= maxOutputTokens) {
+    if (typeof reasoning === "object" && reasoning.budgetTokens >= maxOutputTokens) {
       throw new TypeError("[SixbModels] Output allowance must exceed the reasoning token budget.")
     }
     const accounting = await session.accounting()
@@ -92,7 +96,7 @@ export function createModelsRuntime(
       maxSteps: 1,
       rejectLocalToolCalls: true,
       maxOutputTokens,
-      reasoning: input.reasoning,
+      reasoning,
       caching: input.caching,
       signal,
       onModelCallEnd: async (completed: ModelCallEndEvent) => {

package/src/models/language-model.ts

@@ -83,6 +83,12 @@ export interface LanguageModel {
   readonly modelId: string
   readonly definition: LanguageModelDefinition
   readonly costEstimator?: ModelCostEstimator
+  /**
+   * Reasoning Sixb applies whenever this model runs without an explicit choice: chat turns, AI
+   * workflow steps, subagents, and direct generation. Providers set it from their model options;
+   * Sixb checks it against `definition.capabilities` at startup.
+   */
+  readonly defaultReasoning?: ModelReasoningLevel
   /**
    * Return an executable model pinned to operational metadata, preserving model identity.
    * `offline` requires a local snapshot without catalog I/O. Workers retain this model

package/src/objects/context/index.ts

@@ -1,6 +1,7 @@
 export { requireLinkDefinition, resolveLinkContext, resolveObjectContext } from "./resolve"
 export type {
   ExecutionObjectContext,
+  ObjectSetContext,
   ResolvedLinkBatchItem,
   ResolvedLinkContext,
   ResolvedObjectContext,

package/src/objects/context/types.ts

@@ -4,6 +4,7 @@
  * Context hierarchy: SixbRuntimeContext → ResolvedObjectContext → ResolvedLinkContext
  */
 
+import type { BlobStorage } from "../../blob-storage"
 import type { ExecutionContext } from "../../execution"
 import type { ObjectLink } from "../../ontology"
 import type { ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
@@ -20,6 +21,12 @@ export interface ExecutionObjectContext extends ResolvedObjectContext {
   readonly execution: ExecutionContext
 }
 
+/** An object set's operations, which also open the files its objects reference. */
+export interface ObjectSetContext extends ExecutionObjectContext {
+  /** Opened only once a FileRef is resolved in a row read with the caller's permissions. */
+  readonly blobStorage: Pick<BlobStorage, "stat" | "open">
+}
+
 /** Resolved context for link operations. */
 export interface ResolvedLinkContext extends ResolvedObjectContext {
   readonly linkDefinition: ObjectLink

package/src/objects/execution.ts

@@ -1,3 +1,4 @@
+import type { BlobStorage } from "../blob-storage"
 import { shareSixbErrorReporter } from "../error-reporting/capability"
 import type { ExecutionContext } from "../execution"
 import {
@@ -147,7 +148,8 @@ export interface ObjectsRuntime extends ExecutionObjectOperations {
 
 export function createObjectsRuntime(
   runtime: SixbRuntimeContext,
-  execution: ExecutionContext
+  execution: ExecutionContext,
+  blobStorage: Pick<BlobStorage, "stat" | "open">
 ): ObjectsRuntime {
   const runtimeAuthorization = runtime.runtimeAuthorization
   const objectReader = runtime.objectReader
@@ -180,6 +182,7 @@ export function createObjectsRuntime(
         ...capturedRuntime,
         execution,
         objectType,
+        blobStorage,
       }) as ExecutionObjectSet<TObjectType>
     },
     {

package/src/objects/materializer-adapter.ts

@@ -25,6 +25,7 @@ import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
 import {
   assertKnownProperties,
   assertLinkTargetType,
+  assertValidFileRefs,
   normalizeLinkProperties,
   normalizeObjectProperties,
   validateLinkProperties,
@@ -146,6 +147,7 @@ export function normalizeRuntimeObject(input: {
   const { objectType, primaryPropertyId, properties, valueTypesById } = input
   assertKnownProperties(objectType, properties)
   validateObjectProperties(objectType, properties, valueTypesById)
+  assertValidFileRefs(properties, objectType.id)
 
   const primaryValue = properties[primaryPropertyId]
   if (primaryValue === undefined || primaryValue === null) {
@@ -185,6 +187,7 @@ export function normalizeRuntimeLink(input: {
   const { objectType, linkDefinition, linkId, targetTypeId, properties, valueTypesById } = input
   assertLinkTargetType(objectType.id, linkId, linkDefinition, targetTypeId, input.isValidLinkTarget)
   validateLinkProperties(objectType, linkDefinition, properties, undefined, valueTypesById)
+  assertValidFileRefs(properties, `${objectType.id}.${linkId}`)
   const normalized = normalizeLinkProperties(objectType, linkDefinition, properties, valueTypesById)
   if (normalized === undefined) return undefined
   return normalizeJsonProperties(normalized, `${objectType.id}.${linkId} properties`)

package/src/objects/object/upsert-batch.ts

@@ -52,6 +52,9 @@ export async function upsertObjectBatch(
         ],
       }
     },
-    value: ([outcome]) => toObjectRow(ctx.projectId, requireEffectiveObject(outcome)),
+    value: ([outcome]) =>
+      ctx.objectReader.redactWrittenRow(
+        toObjectRow(ctx.projectId, requireEffectiveObject(outcome))
+      ),
   })
 }

package/src/objects/object/upsert.ts

@@ -34,5 +34,7 @@ export async function upsertObject(
   const commit = await commitRuntimeOperations(ctx, [
     objectUpsertOperation({ id: runtimeOperationId(0), ref, properties: normalized.properties }),
   ])
-  return toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0]))
+  return ctx.objectReader.redactWrittenRow(
+    toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0]))
+  )
 }

package/src/objects/property-clearance.ts

@@ -0,0 +1,209 @@
+import { AuthorizationError } from "../authorization/errors"
+import type { StoredDomainEvent } from "../events/types"
+import type { OntologyDefinitionCatalog } from "../ontology/registry"
+import { missingClearanceRedactions } from "../security/redactions"
+import type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from "../storage"
+import type {
+  ObjectQueryAdmissionState,
+  ObjectQueryPropertyUse,
+  ObjectQuerySemanticAdmission,
+} from "./query/validate"
+
+/**
+ * The marked properties one reader cannot read, resolved once from its clearances.
+ *
+ * A property is readable when the reader clears every one of its markings. Unreadable properties
+ * are omitted from rows and cannot be used to select, order, or aggregate objects.
+ */
+export interface PropertyClearance {
+  /** Marked properties of this object type the reader cannot read. */
+  hiddenPropertyIds(objectTypeId: string): ReadonlySet<string>
+  /** First marking on the property that the reader is not cleared for. */
+  missingMarking(objectTypeId: string, propertyId: string): string | undefined
+}
+
+const NO_PROPERTIES: ReadonlySet<string> = new Set()
+
+// Readers are built per execution, but few distinct clearance sets exist per ontology.
+const clearancesByOntology = new WeakMap<
+  OntologyDefinitionCatalog,
+  Map<string, PropertyClearance | undefined>
+>()
+
+/**
+ * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read
+ * every property, so callers skip redaction entirely.
+ */
+export function resolvePropertyClearance(
+  ontology: OntologyDefinitionCatalog,
+  clearances: ReadonlySet<string>
+): PropertyClearance | undefined {
+  let resolved = clearancesByOntology.get(ontology)
+  if (!resolved) {
+    resolved = new Map()
+    clearancesByOntology.set(ontology, resolved)
+  }
+  const key = JSON.stringify([...clearances].sort())
+  if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))
+  return resolved.get(key)
+}
+
+function createPropertyClearance(
+  ontology: OntologyDefinitionCatalog,
+  clearances: ReadonlySet<string>
+): PropertyClearance | undefined {
+  const missingByType = new Map<string, ReadonlyMap<string, string>>()
+  for (const objectType of ontology.listObjectTypes()) {
+    const missing = new Map<string, string>()
+    for (const property of objectType.properties) {
+      const marking = property.markings?.find((markingId) => !clearances.has(markingId))
+      if (marking !== undefined) missing.set(property.id, marking)
+    }
+    if (missing.size > 0) missingByType.set(objectType.id, missing)
+  }
+  if (missingByType.size === 0) return undefined
+
+  const hiddenByType = new Map(
+    [...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())])
+  )
+  return Object.freeze({
+    hiddenPropertyIds: (objectTypeId: string) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,
+    missingMarking: (objectTypeId: string, propertyId: string) =>
+      missingByType.get(objectTypeId)?.get(propertyId),
+  })
+}
+
+/**
+ * Omit unreadable properties from a row and the objects expanded under it.
+ *
+ * Every hidden property of the type is listed in `redactions`, whether or not the row holds a
+ * value: listing only present values would reveal which hidden properties are empty.
+ */
+export function redactObjectRow<TRow extends ObjectRow>(
+  row: TRow,
+  clearance: PropertyClearance
+): TRow {
+  const hidden = clearance.hiddenPropertyIds(row.objectTypeId)
+  const links = row.links
+  if (hidden.size === 0 && links === undefined) return row
+
+  const redacted: TRow = { ...row }
+  if (hidden.size > 0) {
+    redacted.properties = withoutKeys(row.properties, hidden)
+    redacted.redactions = missingClearanceRedactions(hidden)
+  }
+  if (links !== undefined) {
+    redacted.links = Object.fromEntries(
+      Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)])
+    )
+  }
+  return redacted
+}
+
+function redactLinkValue(
+  value: ExpandedLinkValue,
+  clearance: PropertyClearance
+): ExpandedLinkValue {
+  if (value === null) return null
+  if (Array.isArray(value)) return value.map((row) => redactObjectRow(row, clearance))
+  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.
+  return redactObjectRow(value as ExpandedObjectRow, clearance)
+}
+
+/**
+ * Omit unreadable properties from an object event, under the same contract as rows. Other events
+ * carry no markable value: link properties and telemetry properties cannot be marked.
+ */
+export function redactDomainEvent(
+  event: StoredDomainEvent,
+  clearance: PropertyClearance
+): StoredDomainEvent {
+  if (event.topic !== "objects") return event
+  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId)
+  if (hidden.size === 0) return event
+
+  const payload = {
+    ...event.payload,
+    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),
+    redactions: missingClearanceRedactions(hidden),
+  }
+  if (event.type === "object.deleted") return { ...event, payload }
+  return {
+    ...event,
+    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) },
+  }
+}
+
+function withoutKeys<TValue>(
+  record: Readonly<Record<string, TValue>>,
+  hidden: ReadonlySet<string>
+): Record<string, TValue> {
+  const kept: Record<string, TValue> = {}
+  for (const [key, value] of Object.entries(record)) {
+    if (!hidden.has(key)) kept[key] = value
+  }
+  return kept
+}
+
+/**
+ * Reject every query use of a property the reader cannot read, except projection.
+ *
+ * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which
+ * objects match and in what order. Projection only shapes the output, which is redacted anyway.
+ */
+export function createClearanceQueryAdmission(
+  clearance: PropertyClearance
+): ObjectQuerySemanticAdmission {
+  // Each state stands for the object types a query has reached so far. A property without an
+  // explicit type is checked against all of them.
+  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()
+  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {
+    const created = Object.freeze({})
+    reachedTypes.set(created, Object.freeze([...objectTypeIds]))
+    return created
+  }
+  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {
+    const objectTypeIds = reachedTypes.get(input)
+    if (!objectTypeIds) {
+      throw new Error("[Sixb] Clearance query admission received a state it did not create.")
+    }
+    return objectTypeIds
+  }
+  const empty = state([])
+
+  const admission: ObjectQuerySemanticAdmission = {
+    empty: () => empty,
+    source: (input) => ({ state: state(input.result.objectTypeIds) }),
+    edge: (input) => ({ state: state(input.result.objectTypeIds) }),
+    // A difference only returns objects of its first input.
+    set: (input) =>
+      input.op === "subtract"
+        ? (input.states[0] ?? empty)
+        : state([...new Set(input.states.flatMap(reached))]),
+    property: (input) => {
+      if (input.use === "project") return undefined
+      const objectTypeIds =
+        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]
+      for (const objectTypeId of objectTypeIds) {
+        const marking = clearance.missingMarking(objectTypeId, input.propertyId)
+        if (marking === undefined) continue
+        return new AuthorizationError(
+          `clearance:marking:${marking}`,
+          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`
+        )
+      }
+      return undefined
+    },
+  }
+  return Object.freeze(admission)
+}
+
+const PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {
+  filter: "filter by",
+  text: "search",
+  vector: "run a vector search over",
+  sort: "sort by",
+  project: "project",
+  "expand.orderBy": "order expanded objects by",
+  facet: "facet by",
+}