@sixb/core 0.1.18 → 0.1.20

package/src/auth/cookies.ts

@@ -1,9 +1,8 @@
-import type { AuthSessionAudience } from "./audience"
-import { DEFAULT_AUTH_SESSION_AUDIENCE, resolveAuthSessionAudience } from "./audience"
 import type { AuthCookieOptions } from "./types"
 
-export const DEFAULT_SESSION_COOKIE_NAME = "sixb_session"
-export const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf"
+// The names the app's cookies had beside Atlas's, so its sessions survived Atlas leaving.
+export const DEFAULT_SESSION_COOKIE_NAME = "sixb_session_app"
+export const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf_app"
 
 export interface ResolvedAuthCookieOptions {
   readonly sessionCookieName: string
@@ -41,22 +40,6 @@ export function resolveAuthCookieOptions(
   return resolved
 }
 
-export function resolveAuthCookieOptionsForAudience(
-  options: ResolvedAuthCookieOptions,
-  audience: AuthSessionAudience | undefined
-): ResolvedAuthCookieOptions {
-  const resolvedAudience = resolveAuthSessionAudience(audience)
-  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {
-    return options
-  }
-
-  return {
-    ...options,
-    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,
-    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`,
-  }
-}
-
 export function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {
   const cookies = new Map<string, string>()
   if (!header) {

package/src/auth/index.ts

@@ -9,12 +9,6 @@ export {
   parseAccessTokenValue,
   SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX,
 } from "./access-tokens"
-export type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience"
-export {
-  DEFAULT_AUTH_SESSION_AUDIENCE,
-  isValidAuthSessionAudience,
-  resolveAuthSessionAudience,
-} from "./audience"
 export { getRequestClientAddress, setRequestClientAddress } from "./client-address"
 export {
   clearCsrfCookieHeader,

package/src/auth/runtime.ts

@@ -1,9 +1,5 @@
 import { randomUUID } from "node:crypto"
-import {
-  type AuthorizationContext,
-  canAccessApplication,
-  resolveAuthorizationContext,
-} from "../authorization"
+import { type AuthorizationContext, resolveAuthorizationContext } from "../authorization"
 import {
   canPerformMembershipOperation,
   type GroupReference,
@@ -33,13 +29,8 @@ import {
   hashAccessTokenSecret,
   parseAccessTokenValue,
 } from "./access-tokens"
-import { type AuthSessionAudience, DEFAULT_AUTH_SESSION_AUDIENCE } from "./audience"
 import { getRequestClientAddress } from "./client-address"
-import {
-  getCookie,
-  type ResolvedAuthCookieOptions,
-  resolveAuthCookieOptionsForAudience,
-} from "./cookies"
+import { getCookie, type ResolvedAuthCookieOptions } from "./cookies"
 import { AuthRuntimeError } from "./errors"
 import { SessionCache } from "./session-cache"
 import {
@@ -108,7 +99,6 @@ import {
   isInvitationDeliveryAuthStrategy,
   normalizePagination,
   resolveAuthConfig,
-  resolveAuthSessionAudience,
   resolveInvitationExpiresAt,
 } from "./validation"
 
@@ -184,8 +174,8 @@ export class AuthRuntime {
     }
   }
 
-  getCookieOptions(options: AuthSessionResolutionOptions = {}): ResolvedAuthCookieOptions {
-    return resolveAuthCookieOptionsForAudience(this.config.cookies, options.audience)
+  getCookieOptions(): ResolvedAuthCookieOptions {
+    return this.config.cookies
   }
 
   assertCanServeHttp(params: { readonly production: boolean }): void {
@@ -240,8 +230,6 @@ export class AuthRuntime {
       return { authenticated: false, reason: "auth_disabled" }
     }
 
-    const audience = resolveAuthSessionAudience(options.audience)
-
     if (options.credentialSource === "any") {
       const tokenValue = getBearerAccessTokenValue(request)
       if (tokenValue?.startsWith(SESSION_ACCESS_TOKEN_PREFIX)) {
@@ -257,15 +245,14 @@ export class AuthRuntime {
       }
     }
 
-    return this.resolveCookieSession(request, audience, options.sessionActivity)
+    return this.resolveCookieSession(request, options.sessionActivity)
   }
 
   private async resolveCookieSession(
     request: Request,
-    audience: ReturnType<typeof resolveAuthSessionAudience>,
     activity: AuthSessionResolutionOptions["sessionActivity"]
   ): Promise<AuthSessionResult> {
-    const cookieOptions = this.getCookieOptions({ audience })
+    const cookieOptions = this.getCookieOptions()
     const cookieValue = getCookie(request, cookieOptions.sessionCookieName)
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" }
@@ -283,7 +270,6 @@ export class AuthRuntime {
       sessionId: parts.sessionId,
       tokenHash,
       transport: "cookie",
-      audience,
       nowMs,
     })
     if (cached) {
@@ -298,7 +284,6 @@ export class AuthRuntime {
     let session = await storage.sessions.findValidByTokenHash({
       projectId: this.projectId,
       id: parts.sessionId,
-      audience,
       tokenHash,
       now,
     })
@@ -312,7 +297,6 @@ export class AuthRuntime {
       const renewed = await storage.sessions.renewIfValid({
         projectId: this.projectId,
         id: parts.sessionId,
-        audience,
         tokenHash,
         now,
         expiresAt: this.getRenewedSessionExpiresAt(session, nowMs),
@@ -388,7 +372,6 @@ export class AuthRuntime {
     this.sessionCache?.set({
       sessionId: session.id,
       tokenHash,
-      audience: session.audience,
       session: result,
       nowMs: now.getTime(),
       sessionExpiresAtMs: session.expiresAt.getTime(),
@@ -418,8 +401,6 @@ export class AuthRuntime {
         projectId: this.projectId,
         userId: input.userId,
         strategyId: "device",
-        // A native session belongs to no web app. The column needs a value; nothing reads it.
-        audience: DEFAULT_AUTH_SESSION_AUDIENCE,
         tokenHash: tokens.tokenHash,
         createdAt: input.now,
         ...this.createSessionDeadlines(input.now),
@@ -712,6 +693,11 @@ export class AuthRuntime {
     caller: AuthenticatedUserRequestSession
   ): Promise<ListServiceAccountsResult> {
     const storage = this.requireAuthStorage()
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      return { serviceAccounts: [] }
+    }
+
     const result = await storage.serviceAccounts.list({
       projectId: this.projectId,
       order: "desc",
@@ -724,11 +710,11 @@ export class AuthRuntime {
       }))
     )
 
-    // A caller only sees the service accounts it is allowed to manage, so
-    // listing never leaks the groups of more-privileged accounts.
+    // A caller only sees the service accounts its membership policies cover, so
+    // listing never leaks the groups of accounts outside its scope.
     return {
       serviceAccounts: withGroups.filter(({ groupIds }) =>
-        callerCanManageServiceAccount(caller.groupIds, groupIds)
+        canPerformMembershipOperation(scope, "serviceAccounts", groupIds)
       ),
     }
   }
@@ -738,11 +724,9 @@ export class AuthRuntime {
     input: CreateServiceAccountInput
   ): Promise<CreateServiceAccountResult> {
     const storage = this.requireAuthStorage()
-    // A caller can only place a service account in groups it itself belongs to.
-    const groupIds =
-      constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
-        subject: "service account",
-      }) ?? []
+    // A caller can only place a service account in groups its `serviceAccounts` policies cover.
+    const groupIds = normalizeRequestedGroupIds(input.groupIds) ?? []
+    this.assertCanManageServiceAccountGroups(caller.groupIds, groupIds)
     const now = new Date()
     const serviceAccount = await storage.serviceAccounts.create({
       id: input.id ?? `svc_${randomUUID()}`,
@@ -829,8 +813,8 @@ export class AuthRuntime {
     }
 
     // The token can only carry groups the service account already holds; the
-    // manageability check above guarantees those are a subset of the caller's
-    // own groups, so the caller can never mint privileges it lacks.
+    // manageability check above guarantees those are within the caller's
+    // `serviceAccounts` scope, so the token never reaches past that scope.
     const groupIds = constrainRequestedGroupIds(input.groupIds, serviceAccountGroupIds, {
       subject: "service account token",
     })
@@ -888,12 +872,10 @@ export class AuthRuntime {
   /**
    * Resolve a service account the caller is allowed to manage.
    *
-   * A caller may manage a service account only when it belongs to every group
-   * the account is in ("you can manage what you could have created"). This
-   * confines token minting, disabling, and revocation to privileges the caller
-   * already holds and prevents a service-account token from outliving the
-   * caller's own access. Missing and non-manageable accounts raise the same
-   * error so callers cannot probe which privileged accounts exist.
+   * A caller needs a membership policy with the `serviceAccounts` operation whose scope covers every
+   * group the account is in ("you can manage what you could have created"). This confines token
+   * minting, disabling, and revocation to the groups the project's policies hand out. Missing and
+   * out-of-scope accounts raise the same error so callers cannot probe which accounts exist.
    */
   private async requireManageableServiceAccount(
     storage: AuthStorage,
@@ -903,6 +885,11 @@ export class AuthRuntime {
     readonly serviceAccount: ServiceAccountRecord
     readonly groupIds: readonly string[]
   }> {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds)
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError()
+    }
+
     const serviceAccount = await storage.serviceAccounts.getById({
       projectId: this.projectId,
       id: serviceAccountId,
@@ -911,7 +898,7 @@ export class AuthRuntime {
       ? await this.listServiceAccountGroupIds(storage, serviceAccountId)
       : []
 
-    if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
+    if (!serviceAccount || !canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
       throw new AuthStorageError(
         "missing_service_account",
         `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`
@@ -975,6 +962,7 @@ export class AuthRuntime {
     return {
       // The member-admin edit-groups dialog assigns from the `assignGroups` scope.
       groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
+      serviceAccountGroups: this.scopedGroupOptions(scope.operations.serviceAccounts.groupIds),
       capabilities: membershipCapabilities(scope).holds,
     }
   }
@@ -1163,7 +1151,7 @@ export class AuthRuntime {
     return { user: reactivated, groupIds, managedGroupIds }
   }
 
-  /** The caller's active sessions across every audience, most recently active first. */
+  /** The caller's active sessions, most recently active first. */
   async listSessions(caller: AuthenticatedUserRequestSession): Promise<readonly SessionRecord[]> {
     return this.requireAuthStorage().sessions.listActiveByUserId({
       projectId: this.projectId,
@@ -1195,7 +1183,7 @@ export class AuthRuntime {
     return true
   }
 
-  /** End every active session of the caller, across audiences. Returns how many ended. */
+  /** End every active session of the caller. Returns how many ended. */
   async revokeAllSessions(caller: AuthenticatedUserRequestSession): Promise<number> {
     const revoked = await this.requireAuthStorage().sessions.revokeActiveForUser({
       projectId: this.projectId,
@@ -1284,7 +1272,6 @@ export class AuthRuntime {
     }
 
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now)
-    this.assertInvitationApplicationAccess(groupIds, destination.audience)
 
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID()}`,
@@ -1304,7 +1291,6 @@ export class AuthRuntime {
         projectId: this.projectId,
         authStorage,
         invitation,
-        audience: destination.audience,
         returnTo: destination.returnTo,
         requestOrigin: destination.requestOrigin,
         revealLink: input.revealLink,
@@ -1451,27 +1437,6 @@ export class AuthRuntime {
     return { state: "enabled" }
   }
 
-  private assertInvitationApplicationAccess(
-    groupIds: readonly string[],
-    audience: AuthSessionAudience
-  ): void {
-    // Check only the groups this invitation assigns. Existing memberships may
-    // be outside the caller's policy scope and must not affect this response.
-    const roles = this.security.listResolvedRoles()
-    const authorization = resolveAuthorizationContext({
-      principal: { type: "user", id: "invited-user" },
-      groupIds,
-      roles,
-    })
-
-    if (canAccessApplication(authorization, roles, audience)) return
-
-    throw new AuthRuntimeError(
-      "authorization_denied",
-      `[Sixb] Invitation groups do not grant access to application '${audience}'.`
-    )
-  }
-
   private async assertCanInviteRecipient(
     strategy: InvitationDeliveryAuthStrategy,
     authStorage: AuthStorage,
@@ -1524,6 +1489,27 @@ export class AuthRuntime {
     )
   }
 
+  private assertCanManageServiceAccountGroups(
+    callerGroupIds: readonly string[],
+    groupIds: readonly string[]
+  ): void {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds)
+
+    if (canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
+      return
+    }
+
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError()
+    }
+
+    const missing = missingMembershipGroupIds(scope, "serviceAccounts", groupIds)
+    throw new AuthRuntimeError(
+      "authorization_denied",
+      `[Sixb] The current user is not allowed to place service accounts in group(s): ${missing.join(", ")}.`
+    )
+  }
+
   private assertCanManageInvitationGroups(
     callerGroupIds: readonly string[],
     groupIds: readonly string[]
@@ -1590,15 +1576,11 @@ function constrainTokenGroupIds(
   return principalGroupIds.filter((groupId) => allowed.has(groupId))
 }
 
-// A caller may manage a service account only when it belongs to every group the
-// account is in, so managing it can never grant more than the caller already
-// has. An account with no groups is powerless and therefore freely manageable.
-function callerCanManageServiceAccount(
-  callerGroupIds: readonly string[],
-  serviceAccountGroupIds: readonly string[]
-): boolean {
-  const callerGroups = new Set(callerGroupIds)
-  return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId))
+function missingServiceAccountsPolicyError(): AuthRuntimeError {
+  return new AuthRuntimeError(
+    "authorization_denied",
+    "[Sixb] Managing service accounts needs a membership policy with the 'serviceAccounts' operation."
+  )
 }
 
 function missingAccessTokenError(tokenId: string, projectId: string): AuthStorageError {
@@ -1701,6 +1683,7 @@ function membershipCapabilities(scope: MembershipPolicyScope): MembershipCapabil
       invite: scope.operations.invite.policyIds.length > 0,
       assignGroups: scope.operations.assignGroups.policyIds.length > 0,
       suspend: scope.operations.suspend.policyIds.length > 0,
+      serviceAccounts: scope.operations.serviceAccounts.policyIds.length > 0,
     },
     assignableGroupIds: [...scope.operations.assignGroups.groupIds],
     covers: (operation, memberGroups) =>

package/src/auth/session-cache.ts

@@ -1,10 +1,8 @@
-import type { AuthSessionAudience } from "./audience"
 import type { AuthenticatedAuthSession } from "./types"
 
 interface SessionCacheEntry {
   readonly tokenHash: string
   readonly transport: "cookie" | "bearer"
-  readonly audience: AuthSessionAudience
   readonly session: AuthenticatedAuthSession
   readonly expiresAtMs: number
 }
@@ -14,15 +12,12 @@ export interface SessionCacheGetInput {
   readonly tokenHash: string
   /** A cookie is only ever answered from a cookie entry, and a bearer token from a bearer entry. */
   readonly transport: "cookie" | "bearer"
-  /** The browser audience a cookie was read for. Bearer sessions carry their own. */
-  readonly audience?: AuthSessionAudience
   readonly nowMs: number
 }
 
 export interface SessionCacheSetInput {
   readonly sessionId: string
   readonly tokenHash: string
-  readonly audience: AuthSessionAudience
   readonly nowMs: number
   readonly session: AuthenticatedAuthSession
   readonly sessionExpiresAtMs: number
@@ -38,7 +33,7 @@ export interface SessionCacheSetInput {
  * API stalls. Caching the resolved result for a short TTL collapses those reads to one
  * per session per window.
  *
- * Safety: entries are pinned to the exact token hash, transport, and audience that produced them and
+ * Safety: entries are pinned to the exact token hash and transport that produced them and
  * are never served past the session's rolling or absolute deadline. The short TTL bounds how long
  * a revoked session can linger; sign-out additionally invalidates eagerly via
  * {@link SessionCache.invalidate}.
@@ -60,8 +55,7 @@ export class SessionCache {
     if (
       entry.expiresAtMs <= input.nowMs ||
       entry.tokenHash !== input.tokenHash ||
-      entry.transport !== input.transport ||
-      (input.audience !== undefined && entry.audience !== input.audience)
+      entry.transport !== input.transport
     ) {
       this.entries.delete(input.sessionId)
       return undefined
@@ -88,7 +82,6 @@ export class SessionCache {
     this.entries.set(input.sessionId, {
       tokenHash: input.tokenHash,
       transport: bearer ? "bearer" : "cookie",
-      audience: input.audience,
       session: input.session,
       expiresAtMs,
     })

package/src/auth/types.ts

@@ -11,7 +11,6 @@ import type {
   SessionRecord,
   UserRecord,
 } from "../storage/auth"
-import type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience"
 
 export type Principal =
   | { readonly type: "user"; readonly id: string }
@@ -63,7 +62,6 @@ export interface InvitationDeliveryInput {
   readonly projectId: string
   readonly authStorage: AuthStorage
   readonly invitation: InvitationRecord
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
   readonly requestOrigin: string
   /** Return the delivered link once so the inviter can copy it through an approved channel. */
@@ -98,7 +96,6 @@ export interface MagicLinkRequestInput {
   readonly projectId: string
   readonly authStorage: AuthStorage
   readonly email: string
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
   readonly requestOrigin: string
   /**
@@ -140,7 +137,6 @@ export interface MagicLinkCallbackInput {
 }
 
 export interface MagicLinkCallbackResult extends CompleteSignInResult {
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
 }
 
@@ -182,7 +178,6 @@ export interface MagicLinkAuthStrategy extends InvitationDeliveryAuthStrategy {
 export interface OidcStartSignInInput {
   readonly projectId: string
   readonly authStorage: AuthStorage
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
   readonly requestOrigin: string
   readonly now?: Date
@@ -208,7 +203,6 @@ export interface OidcCallbackInput {
 }
 
 export interface OidcCallbackResult extends CompleteSignInResult {
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
 }
 
@@ -277,11 +271,14 @@ export interface MembershipOperationCapabilities {
   readonly invite: boolean
   readonly assignGroups: boolean
   readonly suspend: boolean
+  readonly serviceAccounts: boolean
 }
 
 export interface GetMembershipOptionsResult {
   /** Groups the caller may assign to a member (the `assignGroups` scope). */
   readonly groups: readonly InvitationGroupOption[]
+  /** Groups the caller may place a service account in (the `serviceAccounts` scope). */
+  readonly serviceAccountGroups: readonly InvitationGroupOption[]
   readonly capabilities: MembershipOperationCapabilities
 }
 
@@ -377,7 +374,7 @@ export interface ReactivateMemberResult {
 /** `"session"` reads only the cookie; `"any"` reads a bearer access token, else the cookie. */
 export type AuthCredentialSource = "session" | "any"
 
-export interface AuthSessionResolutionOptions extends AuthSessionAudienceOptions {
+export interface AuthSessionResolutionOptions {
   readonly credentialSource?: AuthCredentialSource
   /** Marks this request as eligible to renew a near-expiry browser session. */
   readonly sessionActivity?: "foreground"
@@ -385,7 +382,6 @@ export interface AuthSessionResolutionOptions extends AuthSessionAudienceOptions
 
 /** Where an invitation link sends its recipient. */
 export interface InvitationDestination {
-  readonly audience: AuthSessionAudience
   readonly requestOrigin: string
   readonly returnTo: string
 }

package/src/auth/validation.ts

@@ -22,8 +22,6 @@ export const MAX_AUTH_INVITATION_TTL_MS = 30 * DAY
  */
 export const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5_000
 
-export { resolveAuthSessionAudience } from "./audience"
-
 export function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig {
   if (!config) {
     return {

package/src/authorization/decision.ts

@@ -10,7 +10,6 @@
  * is unrestricted.
  */
 
-import type { AuthSessionAudience } from "../auth/audience"
 import {
   type ResolvedRuntimeAuthorization,
   resolveExecutionScopeAuthorization,
@@ -18,12 +17,11 @@ import {
 } from "../execution/authorization"
 import type { ExecutionContext, RuntimeAuthorization } from "../execution/types"
 import { AuthorizationError } from "./errors"
-import type { GrantKind } from "./grant-kinds"
+import type { SingletonGrantKind, TargetedGrantKind } from "./grant-kinds"
 import type { AuthorizationContext, GrantIndex } from "./types"
 
 /** Something a principal may attempt, paired with the resource it targets. */
 export type AuthzRequest =
-  | { readonly kind: "application.access"; readonly audience: AuthSessionAudience }
   | { readonly kind: "object.view"; readonly objectTypeId: string }
   | { readonly kind: "dataset.view"; readonly datasetId: string }
   | { readonly kind: "object.edit"; readonly objectTypeId: string }
@@ -59,13 +57,11 @@ interface AuthorizedRuntime {
 // the two can never drift. `kind` is the resolved-index key, so enforcement is
 // a direct lookup with no per-target dispatch.
 type Atom =
-  | { readonly kind: "run:agent" }
-  | { readonly kind: Exclude<GrantKind, "run:agent">; readonly id: string }
+  | { readonly kind: SingletonGrantKind }
+  | { readonly kind: TargetedGrantKind; readonly id: string }
 
 function atomsFor(request: AuthzRequest): readonly Atom[] {
   switch (request.kind) {
-    case "application.access":
-      return [{ kind: "access:application", id: request.audience }]
     case "object.view":
       return [{ kind: "view:object", id: request.objectTypeId }]
     case "dataset.view":
@@ -87,11 +83,11 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
     case "agent.run":
       return [{ kind: "run:agent" }]
     case "logs.observe":
-      return [{ kind: "observe:logs", id: "logs" }]
+      return [{ kind: "observe:logs" }]
     case "aiUsage.observe":
-      return [{ kind: "observe:aiUsage", id: "aiUsage" }]
+      return [{ kind: "observe:aiUsage" }]
     case "aiUsage.manage":
-      return [{ kind: "manage:aiUsage", id: "aiUsage" }]
+      return [{ kind: "manage:aiUsage" }]
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }]
     case "object.query":
@@ -100,20 +96,11 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
 }
 
 function atomKey(atom: Atom): string {
-  if (atom.kind === "run:agent") return atom.kind
-  if (
-    atom.kind === "observe:logs" ||
-    atom.kind === "observe:aiUsage" ||
-    atom.kind === "manage:aiUsage"
-  ) {
-    return atom.kind
-  }
-  return `${atom.kind}:${atom.id}`
+  return "id" in atom ? `${atom.kind}:${atom.id}` : atom.kind
 }
 
 function holds(grants: GrantIndex, atom: Atom): boolean {
-  if (atom.kind === "run:agent") return grants[atom.kind]
-  return grants[atom.kind].has(atom.id)
+  return "id" in atom ? grants[atom.kind].has(atom.id) : grants[atom.kind]
 }
 
 /** Resolve a request against a principal's grants. Never throws. */
@@ -267,8 +254,6 @@ function deniedMessage(
 ): string {
   const principalId = authorization?.principal.id ?? "unknown"
   switch (request.kind) {
-    case "application.access":
-      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`
     case "object.view":
       return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`
     case "dataset.view":

package/src/authorization/event-visibility.ts

@@ -38,18 +38,6 @@ export function canViewEvent(
         }) &&
         isAllowed(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId })
       )
-    case "actions": {
-      // Apply is necessary; for object-bound actions the principal must also be
-      // able to view the subject type, or the event would leak a hidden
-      // object's id/type — mirroring the rule in `canListAction`.
-      if (!isAllowed(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
-        return false
-      }
-      const subject = event.payload.subject
-      return subject.kind === "object"
-        ? isAllowed(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId })
-        : true
-    }
     case "workflows":
       return isAllowed(authorization, {
         kind: "workflow.run",