@sixb/core 0.1.17 → 0.1.19

package/src/events/selectors/builder.ts

@@ -1,11 +1,7 @@
-import type { ActionDefinition } from "../../actions"
 import type { LinkToken, ObjectTypeWithTokens, Property, PropertyToken } from "../../ontology"
 import type { RuleDefinition } from "../../rules"
 import type { DomainEvent } from "../types"
 import type {
-  ActionEventSelectorContext,
-  ActionEventToken,
-  ActionEventTokenOf,
   DatasetEventSelectorContext,
   DatasetEventToken,
   EventSelectorSpec,
@@ -79,13 +75,6 @@ export interface RuleEventSelectorBuilder<TRule extends RuleDefinition>
   resolved(): EventSelectorSpec<RuleEventSelectorContext<TRule, "resolved">>
 }
 
-export interface ActionEventSelectorBuilder<TAction extends ActionEventToken>
-  extends EventSelectorSpec<ActionEventSelectorContext<TAction>> {
-  requested(): EventSelectorSpec<ActionEventSelectorContext<TAction, "requested">>
-  completed(): EventSelectorSpec<ActionEventSelectorContext<TAction, "completed">>
-  failed(): EventSelectorSpec<ActionEventSelectorContext<TAction, "failed">>
-}
-
 export interface DatasetEventSelectorBuilder<TDataset extends DatasetEventToken>
   extends EventSelectorSpec<DatasetEventSelectorContext<TDataset>> {
   updated(): EventSelectorSpec<DatasetEventSelectorContext<TDataset>>
@@ -140,10 +129,6 @@ abstract class EventSelectorSpecView<TContext> implements EventSelectorSpec<TCon
     return this.spec.ruleId
   }
 
-  get actionId(): EventSelectorSpec["actionId"] {
-    return this.spec.actionId
-  }
-
   get datasetId(): EventSelectorSpec["datasetId"] {
     return this.spec.datasetId
   }
@@ -344,31 +329,6 @@ class RuleEventSelectorBuilderImpl<TRule extends RuleDefinition>
   }
 }
 
-class ActionEventSelectorBuilderImpl<TAction extends ActionEventToken>
-  extends EventSelectorSpecView<ActionEventSelectorContext<TAction>>
-  implements ActionEventSelectorBuilder<TAction>
-{
-  requested(): EventSelectorSpec<ActionEventSelectorContext<TAction, "requested">> {
-    return this.withType("action.requested")
-  }
-
-  completed(): EventSelectorSpec<ActionEventSelectorContext<TAction, "completed">> {
-    return this.withType("action.completed")
-  }
-
-  failed(): EventSelectorSpec<ActionEventSelectorContext<TAction, "failed">> {
-    return this.withType("action.failed")
-  }
-
-  private withType<TOperation extends "requested" | "completed" | "failed">(
-    type: `action.${TOperation}`
-  ): EventSelectorSpec<ActionEventSelectorContext<TAction, TOperation>> {
-    return { ...this.spec, types: [type] } as EventSelectorSpec<
-      ActionEventSelectorContext<TAction, TOperation>
-    >
-  }
-}
-
 class DatasetEventSelectorBuilderImpl<TDataset extends DatasetEventToken>
   extends EventSelectorSpecView<DatasetEventSelectorContext<TDataset>>
   implements DatasetEventSelectorBuilder<TDataset>
@@ -437,9 +397,6 @@ export interface EventSelectors {
     objectType: TObjectType
   ): ObjectEventSelectorBuilder<TObjectType>
   rule<TRule extends RuleDefinition>(rule: TRule): RuleEventSelectorBuilder<TRule>
-  action<TAction extends ActionDefinition>(
-    action: TAction
-  ): ActionEventSelectorBuilder<ActionEventTokenOf<TAction>>
   dataset<TDataset extends DatasetEventToken>(
     dataset: TDataset
   ): DatasetEventSelectorBuilder<TDataset>
@@ -461,14 +418,6 @@ export const events: EventSelectors = {
       ruleId: rule.id,
     } as EventSelectorSpec<RuleEventSelectorContext<TRule>>)
   },
-  action<TAction extends ActionDefinition>(
-    action: TAction
-  ): ActionEventSelectorBuilder<ActionEventTokenOf<TAction>> {
-    return new ActionEventSelectorBuilderImpl({
-      topic: "actions",
-      actionId: action.id,
-    } as EventSelectorSpec<ActionEventSelectorContext<ActionEventTokenOf<TAction>>>)
-  },
   dataset<TDataset extends DatasetEventToken>(
     dataset: TDataset
   ): DatasetEventSelectorBuilder<TDataset> {

package/src/events/selectors/index.ts

@@ -1,5 +1,4 @@
 export type {
-  ActionEventSelectorBuilder,
   DatasetEventSelectorBuilder,
   EventPropertySelector,
   EventSelectors,
@@ -12,11 +11,6 @@ export type {
 export { events } from "./builder"
 export { buildEventSelectorPredicate, eventSelectorSpec } from "./predicate"
 export type {
-  ActionEventSelectorContext,
-  ActionEventSelectorEvent,
-  ActionEventSelectorOperation,
-  ActionEventToken,
-  ActionEventTokenOf,
   DatasetEventSelectorContext,
   DatasetEventSelectorEvent,
   DatasetEventToken,

package/src/events/selectors/predicate.ts

@@ -14,7 +14,6 @@ export function eventSelectorSpec(selector: EventSelectorSpec<unknown>): EventSe
       : {}),
     ...(selector.linkId !== undefined ? { linkId: selector.linkId } : {}),
     ...(selector.ruleId !== undefined ? { ruleId: selector.ruleId } : {}),
-    ...(selector.actionId !== undefined ? { actionId: selector.actionId } : {}),
     ...(selector.datasetId !== undefined ? { datasetId: selector.datasetId } : {}),
     ...(selector.syncId !== undefined ? { syncId: selector.syncId } : {}),
     ...(selector.pipelineId !== undefined ? { pipelineId: selector.pipelineId } : {}),
@@ -40,7 +39,6 @@ export function buildEventSelectorPredicate(
     if (filter.linkId !== undefined && scope.linkId !== filter.linkId) return false
     if (filter.ruleId !== undefined && scope.ruleId !== filter.ruleId) return false
     if (filter.runId !== undefined && scope.runId !== filter.runId) return false
-    if (filter.actionId !== undefined && scope.actionId !== filter.actionId) return false
     if (filter.datasetId !== undefined && scope.datasetId !== filter.datasetId) return false
     if (filter.syncId !== undefined && scope.syncId !== filter.syncId) return false
     if (filter.pipelineId !== undefined && scope.pipelineId !== filter.pipelineId) return false

package/src/events/selectors/types.ts

@@ -1,13 +1,6 @@
-import type {
-  ActionBinding,
-  ActionDefinition,
-  ActionParamsConfig,
-  InferActionParams,
-} from "../../actions"
 import type { LinkToken, ObjectRef, ObjectTypeWithTokens, Property } from "../../ontology"
 import type { InferPropertyValue } from "../../ontology/inference"
 import type { RuleDefinition } from "../../rules"
-import type { ActionRunFailure } from "../../storage"
 import type { PropertyChangeOperation } from "../property-changes"
 import type {
   DatasetVersionCommittedEvent,
@@ -45,33 +38,6 @@ export type RuleEventSelectorContext<
   readonly operation: TOperation
 }
 
-export type ActionEventSelectorOperation = "requested" | "completed" | "failed"
-
-export type ActionEventToken<
-  TId extends string = string,
-  TParams extends ActionParamsConfig = ActionParamsConfig,
-  TBinding extends ActionBinding = ActionBinding,
-> = {
-  readonly id: TId
-  readonly params: TParams
-  readonly binding: TBinding
-}
-
-export type ActionEventTokenOf<TAction extends ActionDefinition> = ActionEventToken<
-  TAction["id"],
-  TAction["params"],
-  TAction["binding"]
->
-
-export type ActionEventSelectorContext<
-  TAction extends ActionEventToken = ActionEventToken,
-  TOperation extends ActionEventSelectorOperation = ActionEventSelectorOperation,
-> = {
-  readonly kind: "action"
-  readonly action: TAction
-  readonly operation: TOperation
-}
-
 export type DatasetEventToken<TId extends string = string> = {
   readonly kind: "dataset"
   readonly id: TId
@@ -116,7 +82,6 @@ export type EventSelectorContext =
   | ObjectEventSelectorContext
   | LinkEventSelectorContext
   | RuleEventSelectorContext
-  | ActionEventSelectorContext
   | DatasetEventSelectorContext
   | SyncEventSelectorContext
   | PipelineEventSelectorContext
@@ -138,15 +103,13 @@ export type EventSelectorEvent<TContext> =
       ? LinkEventSelectorEvent<TObjectType, TLink>
       : TContext extends RuleEventSelectorContext<infer TRule, infer TOperation>
         ? RuleEventSelectorEvent<TRule, TOperation>
-        : TContext extends ActionEventSelectorContext<infer TAction, infer TOperation>
-          ? ActionEventSelectorEvent<TAction, TOperation>
-          : TContext extends DatasetEventSelectorContext<infer TDataset>
-            ? DatasetEventSelectorEvent<TDataset>
-            : TContext extends SyncEventSelectorContext<infer TSync, infer TOperation>
-              ? SyncEventSelectorEvent<TSync, TOperation>
-              : TContext extends PipelineEventSelectorContext<infer TPipeline, infer TOperation>
-                ? PipelineEventSelectorEvent<TPipeline, TOperation>
-                : never
+        : TContext extends DatasetEventSelectorContext<infer TDataset>
+          ? DatasetEventSelectorEvent<TDataset>
+          : TContext extends SyncEventSelectorContext<infer TSync, infer TOperation>
+            ? SyncEventSelectorEvent<TSync, TOperation>
+            : TContext extends PipelineEventSelectorContext<infer TPipeline, infer TOperation>
+              ? PipelineEventSelectorEvent<TPipeline, TOperation>
+              : never
 
 export interface ObjectEventSelectorEvent<TObjectType extends ObjectTypeWithTokens> {
   readonly object: {
@@ -176,19 +139,6 @@ export type RuleEventSelectorEvent<
   readonly subject: ObjectRef<RuleSubjectTypeId<TRule>>
 }
 
-export type ActionEventSelectorEvent<
-  TAction extends ActionEventToken = ActionEventToken,
-  TOperation extends ActionEventSelectorOperation = ActionEventSelectorOperation,
-> = {
-  readonly actionId: TAction["id"]
-  readonly runId: string
-} & ActionSubjectEvent<TAction> &
-  (TOperation extends "requested"
-    ? { readonly params: InferActionParams<TAction["params"]> }
-    : TOperation extends "failed"
-      ? { readonly error: ActionRunFailure }
-      : Record<never, never>)
-
 export type DatasetEventSelectorEvent<TDataset extends DatasetEventToken = DatasetEventToken> =
   Omit<DatasetVersionCommittedEvent["payload"], "datasetId"> & {
     readonly datasetId: TDataset["id"]
@@ -220,7 +170,6 @@ export interface EventSelectorSpec<TContext = EventSelectorContext> {
   readonly propertyOperation?: PropertyChangeOperation
   readonly linkId?: string
   readonly ruleId?: string
-  readonly actionId?: string
   readonly datasetId?: string
   readonly syncId?: string
   readonly pipelineId?: string
@@ -249,10 +198,3 @@ type ResolveTargetTypeId<TTarget> = TTarget extends readonly string[]
 
 type RuleSubjectTypeId<TRule extends RuleDefinition> =
   TRule extends RuleDefinition<string, infer TObjectType> ? TObjectType["id"] : string
-
-type ActionSubjectEvent<TAction extends ActionEventToken> = TAction["binding"] extends {
-  readonly kind: "object"
-  readonly objectType: infer TObjectType extends { readonly id: string }
-}
-  ? { readonly subject: ObjectRef<TObjectType["id"]> }
-  : Record<never, never>

package/src/events/types/index.ts

@@ -1,7 +1,6 @@
 import type { JsonValue } from "../../json"
 import type { OntologyMaterializationEvent } from "../../materialization/events"
 import type { EventOrigin } from "../envelope"
-import type { ActionEvent } from "./actions"
 import type { DatasetEvent } from "./datasets"
 import type { LinkEvent } from "./links"
 import type { ObjectEvent } from "./objects"
@@ -28,12 +27,6 @@ export type {
   PropertyChangeMap,
   PropertyChangeOperation,
 } from "../property-changes"
-export type {
-  ActionCompletedEvent,
-  ActionEvent,
-  ActionFailedEvent,
-  ActionRequestedEvent,
-} from "./actions"
 export type { DatasetEvent, DatasetVersionCommittedEvent } from "./datasets"
 export type {
   LinkCreatedEvent,
@@ -82,7 +75,6 @@ export type DomainEvent =
   | ObjectEvent
   | TelemetryEvent
   | LinkEvent
-  | ActionEvent
   | ScheduleEvent
   | RuleEvent
   | SyncEvent
@@ -129,9 +121,6 @@ export type StoredLinkCreatedEvent = StoredOntologyEventOf<"link.created">
 export type StoredLinkUpdatedEvent = StoredOntologyEventOf<"link.updated">
 export type StoredLinkMutationEvent = StoredLinkCreatedEvent | StoredLinkUpdatedEvent
 export type StoredLinkDeletedEvent = StoredOntologyEventOf<"link.deleted">
-export type StoredActionRequestedEvent = Extract<StoredDomainEvent, { type: "action.requested" }>
-export type StoredActionCompletedEvent = Extract<StoredDomainEvent, { type: "action.completed" }>
-export type StoredActionFailedEvent = Extract<StoredDomainEvent, { type: "action.failed" }>
 export type StoredScheduleTriggeredEvent = Extract<
   StoredDomainEvent,
   { type: "schedule.triggered" }

package/src/events/types/objects.ts

@@ -1,3 +1,4 @@
+import type { Redactions } from "../../security/types"
 import type { EventEnvelope } from "../envelope"
 import type { PropertyChangeMap } from "../property-changes"
 
@@ -6,12 +7,16 @@ export interface ObjectMutationEventPayload<TValue = unknown> {
   primaryId: string
   properties: Record<string, TValue>
   propertyChanges: PropertyChangeMap<TValue>
+  /** Properties omitted for this reader, which lacks their clearance. Never stored. */
+  redactions?: Redactions
 }
 
 export interface ObjectDeletedEventPayload<TValue = unknown> {
   objectTypeId: string
   primaryId: string
   propertyChanges: PropertyChangeMap<TValue>
+  /** Properties omitted for this reader, which lacks their clearance. Never stored. */
+  redactions?: Redactions
 }
 
 export interface ObjectCreatedEvent extends EventEnvelope {

package/src/execution/agent.ts

@@ -1,4 +1,6 @@
 import { type AgentExecutionAuthorization, agentServiceAccountId } from "../agents/authority"
+import { bindModelExecutionAttempt } from "../models/execution/binding"
+import type { AiModelCallRecorder } from "../models/execution/model-call-recorder"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
 import type { ExecutionRecord } from "../storage/executions"
 import { ExecutionStorageError } from "../storage/executions"
@@ -107,6 +109,31 @@ export function bindDurableAgentExecution(
   return sixb
 }
 
+/**
+ * Account model calls made through a run's bound SDK — by its tools, or embeddings behind their
+ * searches — like the run's own: same execution attempt, limits, failure state and cancellation.
+ * The attempt is the recorder's, so the two cannot diverge.
+ */
+export function bindAgentModelExecution(
+  sixb: Sixb,
+  input: {
+    readonly signal: AbortSignal
+    readonly accounting: AiModelCallRecorder
+  }
+): void {
+  const { accounting } = input
+  if (accounting.executionId !== sixb.execution.id) {
+    throw new Error(
+      `[Sixb] Agent execution '${sixb.execution.id}' cannot account its model calls to execution '${accounting.executionId}'.`
+    )
+  }
+  bindModelExecutionAttempt(sixb.models, {
+    attempt: accounting.attempt,
+    signal: input.signal,
+    accounting,
+  })
+}
+
 /** Restore one provider-validated Agent execution with its currently resolved grants. */
 export function restoreAgentExecutionScope(input: {
   readonly execution: ExecutionRecord

package/src/execution/authorization.ts

@@ -596,6 +596,7 @@ function snapshotAuthorizationContext(
     groupIds: Object.freeze([...context.groupIds]),
     roleIds: Object.freeze([...context.roleIds]),
     grants: frozenGrants,
+    clearances: new ImmutableGrantSet(context.clearances ?? []),
   })
 }
 

package/src/execution/authorized-object-reader.ts

@@ -8,6 +8,12 @@ import {
   type AuthorizedOntologyView,
   createAuthorizedOntologyView,
 } from "../objects/authorized-ontology-view"
+import {
+  createClearanceQueryAdmission,
+  type PropertyClearance,
+  redactObjectRow,
+  resolvePropertyClearance,
+} from "../objects/property-clearance"
 import {
   countObjects,
   type ExecuteObjectCountInput,
@@ -35,6 +41,8 @@ import {
 } from "../objects/query/selected-read-admission"
 import {
   type AdmittedObjectQuery,
+  composeObjectQueryAdmissions,
+  type ObjectQuerySemanticAdmission,
   validateObjectQuery,
   validateObjectQueryWithAdmission,
 } from "../objects/query/validate"
@@ -50,6 +58,7 @@ import type {
   ObjectFacetRequest,
   ObjectLinkRow,
   ObjectReadStorage,
+  ObjectRow,
   ObjectStorage,
 } from "../storage"
 import { assertObjectReadOutputWithinLimit, MAX_OBJECT_READ_FACETS } from "../storage"
@@ -93,6 +102,8 @@ class AuthorizedObjectReaderImpl {
   readonly #delegatedObjectTypeIds?: ReadonlySet<string>
   readonly #delegatedLinkDefinitions?: ReadonlySet<string>
   readonly #delegatedQueryAdmission?: SelectedObjectQueryAdmission
+  /** Marked properties this authority cannot read; absent when it reads every property. */
+  readonly #clearance?: PropertyClearance
 
   constructor(
     key: typeof readerConstructionKey,
@@ -127,6 +138,7 @@ class AuthorizedObjectReaderImpl {
       input.authority.type === "delegated"
         ? createSelectedObjectQueryAdmission(input.authority.objectRead.scope)
         : undefined
+    this.#clearance = clearanceForAuthority(input.authority, input.ontology)
     this.#runtime = Object.freeze({
       projectId: input.scope.execution.projectId,
       runtimeAuthorization: input.scope.authorization,
@@ -170,12 +182,11 @@ class AuthorizedObjectReaderImpl {
       primaryId: input.primaryId,
     })
     this.#assertObjectTypesViewable([request.objectTypeId])
-    return detachReadResult(
-      await this.#storage.getByPrimaryId({
-        ...request,
-        projectId: this.#runtime.projectId,
-      })
-    )
+    const row = await this.#storage.getByPrimaryId({
+      ...request,
+      projectId: this.#runtime.projectId,
+    })
+    return detachReadResult(row && this.#redact(row))
   }
 
   async getByPrimaryIdBatch(
@@ -188,11 +199,12 @@ class AuthorizedObjectReaderImpl {
       })),
     })
     this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId))
+    const rows = await this.#storage.getByPrimaryIdBatch({
+      ...request,
+      projectId: this.#runtime.projectId,
+    })
     return detachReadResult(
-      await this.#storage.getByPrimaryIdBatch({
-        ...request,
-        projectId: this.#runtime.projectId,
-      })
+      new Map([...rows].map(([key, row]) => [key, this.#redact(row)] as const))
     )
   }
 
@@ -203,6 +215,7 @@ class AuthorizedObjectReaderImpl {
       propertyId: input.propertyId,
     })
     this.#assertObjectTypesViewable([request.objectTypeId])
+    if (this.#hidesProperty(request)) return false
     if (this.#authority.type !== "delegated") return true
     const [readable] = await this.#storage.selectsObjectProperties({
       projectId: this.#runtime.projectId,
@@ -222,12 +235,15 @@ class AuthorizedObjectReaderImpl {
       })),
     })
     this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId))
-    if (this.#authority.type !== "delegated") return request.items.map(() => true)
-    return detachReadResult(
-      await this.#storage.selectsObjectProperties({
-        ...request,
-        projectId: this.#runtime.projectId,
-      })
+    const selected =
+      this.#authority.type === "delegated"
+        ? await this.#storage.selectsObjectProperties({
+            ...request,
+            projectId: this.#runtime.projectId,
+          })
+        : request.items.map(() => true)
+    return request.items.map(
+      (item, index) => !this.#hidesProperty(item) && selected[index] === true
     )
   }
 
@@ -258,13 +274,12 @@ class AuthorizedObjectReaderImpl {
       return { objects: [], hasMore: false, total: 0 }
     }
 
-    return detachReadResult(
-      await this.#storage.list({
-        ...request,
-        ...(objectTypeId === undefined ? {} : { objectTypeId }),
-        projectId: this.#runtime.projectId,
-      })
-    )
+    const page = await this.#storage.list({
+      ...request,
+      ...(objectTypeId === undefined ? {} : { objectTypeId }),
+      projectId: this.#runtime.projectId,
+    })
+    return detachReadResult({ ...page, objects: page.objects.map((row) => this.#redact(row)) })
   }
 
   async listLinks(input: ListLinksInput): ReturnType<ObjectReadStorage["listLinks"]> {
@@ -318,17 +333,16 @@ class AuthorizedObjectReaderImpl {
     const query = snapshotAuthoredQuery(input.query)
     const includeTotal = snapshotReadValue(input.includeTotal)
     const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query
-    return detachReadResult(
-      await executeObjectQuery(
-        {
-          query: executionQuery,
-          ...(includeTotal === undefined ? {} : { includeTotal }),
-          projectId: this.#runtime.projectId,
-          signal: input.signal,
-        },
-        this.#queryExecutorOptions()
-      )
+    const result = await executeObjectQuery(
+      {
+        query: executionQuery,
+        ...(includeTotal === undefined ? {} : { includeTotal }),
+        projectId: this.#runtime.projectId,
+        signal: input.signal,
+      },
+      this.#queryExecutorOptions()
     )
+    return detachReadResult({ ...result, objects: result.objects.map((row) => this.#redact(row)) })
   }
 
   async queryLinks(
@@ -378,7 +392,7 @@ class AuthorizedObjectReaderImpl {
     ) {
       throw new Error("[Sixb] Object storage returned a link page outside its authorized scope.")
     }
-    return result
+    return { ...result, objects: result.objects.map((row) => this.#redact(row)) }
   }
 
   async count(
@@ -450,6 +464,14 @@ class AuthorizedObjectReaderImpl {
     )
   }
 
+  /**
+   * Redact a row returned by a write. An upsert returns the merged effective row, which may hold
+   * marked values the writer never sent and cannot read.
+   */
+  redactWrittenRow<TRow extends ObjectRow>(row: TRow): TRow {
+    return this.#redact(row)
+  }
+
   /** Enforce the delegated response budget without exposing or recombining its limits. */
   assertVisibleOutputWithinLimit(value: unknown): void {
     if (this.#authority.type !== "delegated") return
@@ -464,6 +486,7 @@ class AuthorizedObjectReaderImpl {
   }
 
   #queryExecutorOptions() {
+    const admission = this.#executorAdmission()
     if (this.#authority.type === "delegated") {
       // The selected storage instance is the private execution capability. Passing the delegated
       // runtime token into the generic executor would either reject this admitted query or tempt a
@@ -473,6 +496,7 @@ class AuthorizedObjectReaderImpl {
         storage: this.#storage,
         embeddingModels: this.#embeddingModels,
         rerankingModels: this.#rerankingModels,
+        ...(admission === undefined ? {} : { admission }),
       }
     }
     return {
@@ -484,9 +508,29 @@ class AuthorizedObjectReaderImpl {
       ...(this.#runtime.authorization === undefined
         ? {}
         : { authorization: this.#runtime.authorization }),
+      ...(admission === undefined ? {} : { admission }),
     }
   }
 
+  /**
+   * The executor validates the query it runs, and that validation resolves default text fields.
+   * Every admission that narrows those fields must therefore apply there, not only beforehand.
+   */
+  #executorAdmission(): ObjectQuerySemanticAdmission | undefined {
+    const clearance = this.#clearance && createClearanceQueryAdmission(this.#clearance)
+    const selected = this.#delegatedQueryAdmission
+    if (selected && clearance) return composeObjectQueryAdmissions(selected, clearance)
+    return selected ?? clearance
+  }
+
+  #redact<TRow extends ObjectRow>(row: TRow): TRow {
+    return this.#clearance ? redactObjectRow(row, this.#clearance) : row
+  }
+
+  #hidesProperty(item: { readonly objectTypeId: string; readonly propertyId: string }): boolean {
+    return this.#clearance?.hiddenPropertyIds(item.objectTypeId).has(item.propertyId) ?? false
+  }
+
   #admitDelegatedQuery(query: ObjectQuery): AdmittedObjectQuery | undefined {
     if (!this.#delegatedQueryAdmission) return undefined
     return validateObjectQueryWithAdmission(
@@ -595,6 +639,24 @@ export function getAuthorizedOntologyView(reader: AuthorizedObjectReader): Autho
   return AuthorizedObjectReaderImpl.ontologyView(reader)
 }
 
+/**
+ * Unrestricted authority reads every property. A principal reads what its roles clear; delegated
+ * shared access carries no clearance, so no share can expose a marked property.
+ */
+function clearanceForAuthority(
+  authority: ResolvedExecutionAuthority,
+  ontology: OntologyRegistry
+): PropertyClearance | undefined {
+  switch (authority.type) {
+    case "unrestricted":
+      return undefined
+    case "principal":
+      return resolvePropertyClearance(ontology, authority.context.clearances ?? new Set())
+    case "delegated":
+      return resolvePropertyClearance(ontology, new Set())
+  }
+}
+
 function objectStorageForAuthority(
   authority: ResolvedExecutionAuthority,
   objectStorage: ObjectStorage

package/src/execution/scopes.ts

@@ -146,12 +146,8 @@ export function createTestingScope(input: {
 }
 
 function withoutSession(context: AuthorizationContext): AuthorizationContext {
-  return {
-    principal: context.principal,
-    groupIds: context.groupIds,
-    roleIds: context.roleIds,
-    grants: context.grants,
-  }
+  const { sessionId: _sessionId, ...withoutSessionId } = context
+  return withoutSessionId
 }
 
 function createRequestExecution(input: {

package/src/http/api-routes.ts

@@ -34,7 +34,8 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
   // Token and service-account management is bearer-capable so the CLI can authenticate with a
   // personal access token. It is NOT exposed to agents. The runtime still confines every operation
   // to the caller's own groups, and service-account tokens are rejected (only user principals may
-  // manage credentials).
+  // manage credentials). Creating a token is the exception: it takes a signed-in session, so no
+  // access token can mint one broader or longer-lived than itself.
   {
     operationId: "getAuthAccessManagementOptions",
     method: "GET",
@@ -53,7 +54,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     operationId: "createAuthPersonalAccessToken",
     method: "POST",
     path: "/api/auth/access-tokens",
-    accessToken: true,
+    accessToken: false,
     agentApi: false,
   },
   {
@@ -95,7 +96,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     operationId: "createAuthServiceAccountAccessToken",
     method: "POST",
     path: "/api/auth/service-accounts/:serviceAccountId/access-tokens",
-    accessToken: true,
+    accessToken: false,
     agentApi: false,
   },
   {